Tampered Ledger hardware wallets sold in Singapore retail stores compromised recovery phrases, resulting in S$3.5M in losses and Ledger halting Southeast Asia sales.
Security & Exploits ·
Victims in Singapore have lost approximately S$3.5 million after purchasing Ledger hardware wallets that had been compromised at local retail stores. Police confirmed two cases reported since September 10, revealing that the devices contained malicious components capable of capturing users' recovery phrases and private keys. Such theft could allow unauthorised parties to access cryptocurrency holdings and move assets without victims' awareness. Ledger has paused operations across seven Southeast Asian markets—Singapore, Malaysia, Indonesia, Thailand, the Philippines, Vietnam, and Hong Kong—while reviewing affected cases.
Hardware wallets function as offline storage devices for private keys, offering stronger protection than online alternatives. The tampering appears to have occurred at the point of sale within Singapore's retail channel, though investigations remain active. Ledger has not publicly confirmed the total number of affected customers or verified total losses, though blockchain analysts have estimated damages exceeding US$86 million globally.
Authorities have urged cryptocurrency holders to obtain devices only through official channels, maintain strict confidentiality of recovery phrases and seed phrases, and monitor official advisories from manufacturers. The public can report relevant information to police via hotline 1800-255-0000 or through www.police.gov.sg/i-witness. The precise scope of the supply chain compromise and whether tampered units remain in circulation remain unclear.