Singapore Police Report $2.7 Million in Tampered Ledger Wallet Losses

Singapore police put losses linked to tampered Ledger hardware wallets at about S$3.5 million ($2.7 million), providing a local tally while Ledger has yet to confirm the campaign's overall losses.

In an Oct. 28 advisory, the Singapore Police Force said “at least two cases” had been reported since Sept. 10. Preliminary investigations found malicious hardware components in wallets purchased from “some retail stores in Singapore,” which the advisory did not name. Police said the components could capture recovery phrases or private keys, allowing attackers to transfer assets without owners' knowledge or consent.

The reporting window starts nearly a month before Ledger's Oct. 9 public alert, when the company asked reseller CryptoBilis to halt sales and shipments. Ledger confirmed an unauthorized hardware implant in one affected customer's device on Oct. 10. The police advisory does not say when Ledger learned of the Singapore cases.

The police figure covers the reported Singapore cases, not the entire campaign. Ledger said on Oct. 13 that it had not confirmed the number of affected users or total value lost, and repeated that position on Oct. 22: “Figures circulating online come from third parties and Ledger has not fully verified them.”

In an Oct. 28 post, Ledger said all confirmed losses involved devices sold through a limited number of resellers and that it had not verified a drain linked to a device bought outside Southeast Asia. It said it had no indication its infrastructure, systems, services or direct sales channel had been compromised.

Why a Genuine Device Can Still Be Unsafe

Ledger's Oct. 13 technical account said the implant reads the recovery phrase displayed during setup and sends it over a cellular connection, without modifying the device's security chip or operating system. Its hardware-integrity guide says the Genuine Check authenticity test cannot detect spying implants when the original security chip remains intact.

Singapore police advised users not to enter recovery phrases or transact on suspected devices and to seek help through official support channels. Anyone who suspects their keys or recovery phrase have been compromised should consider moving remaining assets to a trusted wallet with a newly generated recovery phrase on an uncompromised device, police said.

Police said they are in contact with Ledger, which is reviewing the affected cases, and that their investigation remains ongoing.