On October 28, 2026, the Singapore Police Force issued a public advisory revealing that tampered Ledger hardware wallets sold in local retail stores resulted in losses of about $2.7 million across at least two reported cases since September 10, 2026. Preliminary investigations indicate malicious hardware implants were inserted into the devices to capture users' private keys and recovery phrases, enabling unauthorized transfers. Ledger has suspended device sales across seven Asian markets while investigations continue.
Singapore Police investigation into tampered devices
- ▪The Singapore Police Force reported on October 28, 2026, that at least two cases involving tampered Ledger hardware wallets were reported since September 10, 2026, with combined losses of about 3.5 million Singapore dollars ($2.7 million).
- ▪Preliminary investigations by the Singapore Police Force revealed that Ledger hardware wallets bought at certain retail stores in Singapore contained malicious hardware components.
- ▪The Singapore Police Force confirmed it is in contact with Paris-based wallet manufacturer Ledger, which is reviewing the affected cases while police investigations remain ongoing.
- ▪The Singapore Police Force requested members of the public with information on cryptocurrency hardware wallet tampering crimes to call its hotline or submit reports online.
- ▪The Singapore Police Force advisory issued on October 28, 2026, did not identify specific retail stores involved, specify hardware wallet models, detail how components were added, or confirm any arrests.
Reports of tampered devices sold in Singapore
- ▪Former Mt. Gox CEO Mark Karpelès stated that a Ledger Flex hardware wallet purchased at Singapore's Changi Airport contained a spy implant.
- ▪A Ledger user reported receiving a replacement device from Ledger after claiming to have bought a tampered Ledger hardware wallet from Singapore IT retailer Challenger.
How tampered devices captured user keys
- ▪The Singapore Police Force reported that malicious hardware components in tampered Ledger wallets are capable of capturing users' recovery phrases or private keys to enable unauthorized cryptocurrency transfers.
- ▪Ledger explained in an October 13, 2026 technical analysis that hardware implants in earlier tampered devices could capture recovery phrases displayed during device setup and transmit them via cellular links.
Ledger regional response and investigation
- ▪Initial reports of tampered Ledger devices surfaced publicly on October 9, 2026, linked to devices sold through authorized regional reseller CryptoBilis in Indonesia, Malaysia, and the Philippines.
- ▪Ledger requested retailers across seven Asian markets to suspend sales of Ledger devices
- ▪Ledger stated that it could not confirm the number of people affected by the tampered device incidents or the total amount lost.
Police Advice for cryptocurrency holders
- ▪The Singapore Police Force warned cryptocurrency holders never to disclose private keys, recovery phrases, or seed phrases to anyone, including individuals claiming to represent wallet providers, exchanges, or law enforcement.
- ▪The Singapore Police Force advised cryptocurrency holders to avoid entering recovery phrases or transacting on suspected tampered devices and to move remaining assets to a new, trusted wallet with a newly generated recovery phrase.
- ▪The Singapore Police Force urged cryptocurrency holders to be wary of unsolicited messages offering wallet verification or recovery assistance.
Story comments
Loading comments…