Singapore police advisory flags tampered Ledger devices, $3.5 million lost
Security & Exploits ·
Authorities link at least two cases since September 10 to hardware wallets bought from local retailers, urging holders to stop using suspect devices immediately.
Singapore police issued a public notice on October 28, 2026, warning that altered Ledger hardware wallets sold through stores in the city-state have been tied to roughly $3.5 million in losses, according to cryptopotato.com. The advisory does not specify which currency the figure is denominated in, and it covers at least two reported incidents dating back to September 10. Investigators said they are coordinating with Ledger as the company examines the flagged cases, and the inquiry is still in its early stages.
Early findings point to hidden hardware planted inside the devices that can capture a user's recovery phrase or private key, giving outside parties a path to drain wallet contents. Police are telling anyone who suspects their device has been compromised to halt transactions and stop typing in a recovery phrase on it, and to think about moving remaining holdings to a fresh wallet on a clean device, generating an entirely new seed phrase in the process, per defiprime.com.
Ledger's own account, posted October 13, traces the method to a concealed add-on component that reads the recovery phrase as it appears on-screen during setup, then sends the words out over a cellular connection using a built-in eSIM. The company said this add-on sits apart from the device's core security chip and operating software, meaning it does not touch how transactions or signatures are processed. Ledger's narrative, last revised October 15, describes a scheme in which attackers obtained legitimate units, implanted the extra hardware, resealed the packaging, and routed the units back into circulation through resellers across Southeast Asia, backed by infrastructure built over an extended period to harvest phrases and funnel out stolen assets.
That October 13 disclosure named CryptoBilis, a reseller in the region, as the source tied to every confirmed loss from the incident Ledger first revealed on October 9, with the company confirming an implanted component in one customer's unit on October 10. CryptoBilis has since paused sales of Ledger products pending the probe. Ledger has not confirmed a drain connected to a device bought from any other seller, and it has not finalized how many users were affected or the total amount lost. A separate Ledger notice the same day said retailer MediaMarkt Saturn pulled Ledger products from shelves and its website after a German customer reported finding an implant, though no funds were reported stolen in that instance.
It remains unclear whether the Singapore cases trace back to CryptoBilis specifically, since the police advisory does not name the retailers involved or link its figures to that reseller. The final count of affected users, the precise currency behind the $3.5 million estimate, and the scope of Ledger's broader review are all still pending as the investigation continues.