Singapore Police Report S$3.5M Lost to Tampered Ledger Wallets

S$3.5 Million Lost to Tampered Devices

Cryptocurrency users in Singapore have lost about S$3.5 million, roughly $2.7 million, to tampered Ledger hardware wallets bought from local retailers. In an advisory published on Wednesday, the Singapore Police Force said officers have recorded at least two cases since September 10. Preliminary investigations found that some affected units contained unauthorized hardware components capable of capturing a user's recovery phrase or private key, the credential that ultimately controls access to funds on the blockchain. A recovery phrase, typically 12 or 24 words generated during setup, acts as the master backup for the entire wallet. Police said the affected units had been physically modified so they could harvest sensitive information and enable unauthorized transfers. Once an attacker holds the complete phrase, the wallet can be recreated on another device and its balance moved without the owner's consent. Offline isolation is the core promise of a hardware wallet, which keeps keys out of reach of an internet-connected hot wallet setup; a physical implant defeats that protection from inside the sealed package. The force said it is in contact with Ledger, which is reviewing the affected cases while police inquiries continue. The S$3.5 million covers only cases reported in Singapore. It sits apart from an earlier regional estimate in which blockchain analysts put losses tied to compromised wallets above US$86 million, a total Ledger has said it cannot confirm, along with the number of users affected. The company has maintained that its own systems and direct sales channels were not implicated in the confirmed incidents, and police have not said where in the distribution chain the modifications took place.

Karpelès Post Flags Airport Purchase

The tampering case surfaced publicly on October 9, when reports of stolen funds accumulated around devices sold through CryptoBilis, an authorized Ledger reseller operating in Indonesia, Malaysia and the Philippines. Days later, former Mt. Gox CEO Mark Karpelès said in a post that a Ledger Flex he bought at Singapore's airport contained a spy implant. Another user separately claimed to hold a tampered device purchased from IT retailer Challenger, and said Ledger later sent him a replacement. Devices linked to the police cases have been traced to a Metapod store at Changi Airport and a Challenger outlet at VivoCity. Ledger confirmed an unauthorized hardware implant in one affected wallet on October 10 and began examining other reported incidents involving devices bought through the same reseller. Its Donjon security team determined that the component could capture the 24-word recovery phrase shown during setup and transmit it to an attacker over an LTE cellular connection. The implant operated independently of the device's Secure Element, the chip designed to shield keys, and required no changes to the wallet's operating system. On October 13, Ledger asked resellers and distributors in Singapore, Malaysia, Indonesia, Thailand, the Philippines, Vietnam and Hong Kong to suspend sales and shipments while its review continued. Customers who bought devices from CryptoBilis in the previous 90 days were told not to initialize unused wallets, and those already using one were advised to shift their funds to another wallet with a newly generated phrase. The fallout has since spread beyond Southeast Asia: German electronics retailer MediaMarktSaturn halted Ledger sales across its stores and online channels on October 13 after a customer there reported an unauthorized component inside a device, though no funds were lost in that case.

@MagicalTux · X post

Said in a post.

View on X

Read together, the two reports point to a compromise that lived in the distribution layer rather than in Ledger's production lines or infrastructure. The police advisory confirms hard losses in Singapore's retail channel, and the earlier analyst estimate above US$86 million hints the true scope may be wider still, even without a verified figure. The problem is not confined to one vendor either: on October 26, rival maker Keystone disclosed an authentication key breach that exposed data on 25,964 customers and forced the destruction of 18,835 devices, although it said recovery phrases and private keys stayed secure. Weeks of FUD around hardware wallets now rest on a documented police file and a named corporate response. Until the regional channel reopens, buyers should favor direct sales and brush up on the main hardware wallet security threats before initializing any device.