The Singapore Police Force has warned that some Ledger hardware wallets sold through local retailers contained malicious components, resulting in approximately S$3.5 million, or $2.7 million, in stolen digital assets. Police said that at least two cases have been reported since September 10, and urged users to take immediate precautions if they suspect their device may have been compromised.
Alleged hardware tampering and wallet drains
According to the advisory issued on October 28, investigators discovered that unauthorized components inside the affected Ledger wallets were capable of harvesting users’ recovery phrases or private keys. This type of hardware manipulation allowed attackers to remotely access and siphon funds from targeted wallets without owners’ knowledge.
Police authorities stated that they are coordinating with Ledger, which is currently reviewing the cases to determine the extent and method of compromise. The advisory did not specify which wallet models were affected, nor did it disclose which retail stores sold the tampered devices or identify any suspects in the case.
In a previous update released on October 13, Ledger said its team found an unauthorized hardware modification in a device purchased from CryptoBilis, a reseller based in Southeast Asia. The altered component reportedly intercepted the recovery phrase during the wallet’s initial setup and transmitted this sensitive data over LTE networks. That same day, Ledger asked sellers in Singapore and six other Asian markets to temporarily halt sales while investigations were underway.
User safety guidance and industry response
The police advisory instructed anyone who believes their hardware wallet may have been tampered with to immediately stop entering recovery phrases and refrain from sending transactions. Users are advised to reach out directly to Ledger’s official support channels if they suspect their device has been compromised. Police also recommended transferring any remaining funds to a new hardware wallet, set up from scratch with a fresh recovery phrase on a secure device.
Police stressed that users should never share seed phrases—not even with individuals claiming to represent wallet providers, cryptocurrency exchanges, or law enforcement agencies—and encouraged vigilance when handling recovery credentials.
Ledger described the incident as a “localized distribution attack,” differentiating it from large-scale systemic supply chain threats. The company did not specify whether the cases reported in Singapore are directly connected to previously identified wallet drains tied to regional resellers.
In response to recent supply-chain vulnerabilities, rival hardware manufacturer Trezor stated on October 13 that it would reduce its roster of authorized resellers in an effort to minimize similar risks. Austin Campbell, founder of Zero Knowledge Group, also cited these incidents as evidence that self-custody solutions may require greater simplicity to prevent technical end-user errors or supply chain breaches.
Amid heightened concern about compromised wallet hardware and rapid changes in wallet security protocols, ongoing fund drains and related advisories create a pressing need for up-to-date monitoring. With real-time coin-specific news updates, CryptoAppsy enables users to stay informed about critical hardware vulnerabilities and emerging self-custody risks as they develop, helping wallet holders protect their crypto assets during periods of uncertainty.
Ongoing investigation
The Singapore Police stated that investigations are ongoing and urged anyone with relevant information to contact the Police Hotline directly by phone. The advisory did not clarify if the stolen funds were definitively linked to other regional incidents or if the affected victims’ recovery phrases had been circulated online.
The advisory emphasized that individuals who believe their device or credentials may have been compromised should act without delay and transfer their assets to a new, clean wallet environment.
No further details about the stores involved, specific devices, or additional victims have been released as of publication. The ongoing developments have drawn attention to the security practices of hardware wallet vendors and the need for stricter oversight along distribution chains.
