Tampered Ledger wallets cost Singapore users $2.7 million: Police

Singapore users lost about S$3.5 million, roughly US$2.7 million, after buying tampered Ledger cryptocurrency hardware wallets, police said. At least two cases have been reported since Sept. 10, placing the earliest reports nearly a month before the wider incident became public.

In an Oct. 28 advisory, the Singapore Police Force said preliminary investigations found malicious hardware components inside devices purchased from some retail stores in Singapore. Those components could capture recovery phrases or private keys, enabling unauthorized access to wallets and transfers without their owners’ knowledge or consent.

The timing adds an earlier reference point to an incident Ledger publicly began investigating on Oct. 9. The police reporting date establishes when authorities had received complaints, but does not by itself establish when Ledger learned of those particular cases or when the devices were modified.

Hardware wallets are designed to protect the private keys used to control cryptocurrency, rather than hold the assets themselves. A stolen recovery phrase can undermine that protection by allowing someone else to recreate access to the wallet, making the confidentiality of those words central to self-custody security.

Ledger said in an Oct. 15 statement that a criminal group had bought genuine devices, opened them and installed hidden components designed to capture recovery phrases during setup. According to the company, the altered devices were then returned to distribution through resellers in Southeast Asia, placing the attack between manufacture and use.

The company said its chips, operating system and servers had not been compromised, describing the incident as a localized distribution attack. That is Ledger’s assessment of the breach, distinct from the Singapore police’s preliminary findings about devices purchased locally. Neither account establishes that every device sold through the affected retail channels was altered.

Ledger said it asked authorized resellers and distributors to suspend sales in Southeast Asia and Hong Kong. It also announced stricter handling requirements: returned devices must never be resold, products should no longer be kept on shelves or displays, and stock should be handed to customers at purchase. Resellers must promptly report unusual products.

The incident illustrates why protecting cryptocurrency requires attention to how a security device reaches its owner, not only how it operates afterward. A device modified before setup presents a different risk from an online phishing attempt: sensitive information may be exposed during the process intended to establish secure control of funds.

Singapore police said investigations remain ongoing and that Ledger is reviewing the affected cases. Authorities urged users to consult official provider advisories and protect their recovery information. Ledger has promised further technical disclosure when possible, leaving the investigation and that disclosure as the next opportunities to clarify the attack’s scope.