Singapore Police Flag Tampered Ledger Wallets After S$3.5 Million in Losses

The Singapore Police Force (SPF) warned on 28 October 2026 that Ledger hardware wallets sold at some retail stores in the country had been found to contain malicious hardware components, after at least two reported cases produced total losses of about S$3.5 million (roughly US$2.7 million) since 10 September. In the advisory , police said preliminary investigations indicate the tampered devices could capture a buyer’s recovery phrase, letting an unauthorised party empty the wallet without the owner’s knowledge or consent.

The notice carries weight because it moves a problem that had been tied to one Southeast Asian online reseller onto the shelves of physical stores in one of the world’s most developed financial hubs. It is the clearest official confirmation yet that tampered cold-storage devices are reaching ordinary buyers through legitimate-looking retail channels, not just unverified online sellers.

What the Singapore Police Advisory Confirmed

The SPF said at least two cases have been reported since 10 September 2026, with combined losses of about S$3.5 million. The affected hardware is Ledger cryptocurrency wallets bought from “some retail stores in Singapore,” a framing that sets this advisory apart from Ledger’s own October findings, which centred on a single online reseller in the region.

Investigators found the wallets “contained malicious hardware components.” The police described the method in plain language: the components “could capture users’ recovery phrases or private keys, allowing unauthorised persons to access their cryptocurrency wallets and transfer their assets without their knowledge or consent.”

The SPF said it is in contact with Ledger, which is reviewing the affected cases, and that police investigations are ongoing. The advisory does not name any retailer and does not state whether the Singapore devices share a supplier with the tampered units Ledger already identified elsewhere in Southeast Asia.

How a Hardware Implant Bypasses the Secure Element

A Ledger wallet’s security model rests on a secure element, a dedicated chip that generates and stores a user’s private keys so the keys never touch the phone or computer the wallet connects to. A physical implant attacks that model from the outside. Instead of trying to break the chip’s cryptography, an attacker solders an extra component onto the device’s circuit board or swaps a part inside the casing before it reaches the buyer.

That added hardware can then intercept the recovery phrase when the owner types it, or the device may be preloaded with a phrase the attacker already knows, so any funds deposited appear to be safe while the attacker retains the keys. Two implant archetypes account for most documented cases. In the first, the device arrives pre-seeded with a recovery phrase the attacker generated, so the victim deposits funds into a wallet the attacker already controls. In the second, an added chip or modified firmware silently records the phrase the moment the owner types it during setup, then exfiltrates it later. The critical point is that this is a supply-chain compromise, not a software exploit: the secure element itself was not broken, and Ledger’s infrastructure was not accessed.

Ledger Live’s genuine-device check verifies the secure element’s authenticity against Ledger’s records, which is why the company directs every buyer to run it during first setup. A device that fails that check should never receive funds, because a failed check is the strongest early signal that the unit has been opened, swapped, or tampered with before it reached the buyer.

Ledger had already confirmed this exact vector once before in October. In a statement tied to its separate Southeast Asia probe , the company said “one of the impacted users’ devices contained an unauthorized hardware implant,” the first time it had verified physical tampering in a case it began investigating on 9 October .

From a Regional Reseller to a Global Financial Hub

The Singapore advisory broadens the picture. Ledger’s earlier probe was linked to CryptoBilis, a reseller listed for Indonesia, Malaysia, and the Philippines, and on-chain investigator Specter separately estimated that traced losses in that episode had climbed above US$86 million across Ethereum, TRON, and Bitcoin. The Singapore figure is far smaller, roughly 3% of that estimate, but it lands in a different kind of channel: physical retail stores rather than an online seller.

That distinction is what changes the risk assessment. An online reseller with a reputation problem can be paused, and Ledger did exactly that by asking CryptoBilis to halt sales and shipments. Physical retail is harder to fence off, because a tampered unit can sit on a shelf next to a genuine one with no visible difference to the buyer. At about S$1.75 million per case, the two Singapore incidents also suggest each compromise involves substantial holdings rather than small test balances.

Why a Hardware Wallet Is Still Safer Than a Hot Wallet

None of this means cold storage is broken. The advisory describes tampering at the point of sale, not a failure of Ledger’s secure element, its software, or its systems. Devices bought directly from ledger.com, which ships sealed units and lets the companion app run an authenticity check during setup, are a different supply path from a third-party retailer’s shelf stock.

The comparison that matters is still lopsided in the hardware wallet’s favour. A software or exchange-hosted wallet exposes keys to the wider attack surface of a phone or computer, malware, phishing pages, and remote keyloggers can all reach a hot wallet without anyone physically touching a device. A hardware wallet, even one that needs to be checked for tampering, removes the remote attack path almost entirely. The police guidance is procedural, not a recall: it asks buyers to verify their device and to move funds if they suspect compromise, not to abandon cold storage.

What to Check Before You Enter a Recovery Phrase

The SPF’s guidance is specific. Buyers should rely on advisories from their wallet provider, and should not enter a recovery phrase or conduct transactions on a device they suspect has been tampered with. Anyone who thinks their phrase or keys may be compromised should move remaining assets to a new wallet with a freshly generated recovery phrase, created on an uncompromised device. The police also repeated the standing rule: “Never disclose your private keys, recovery or seed phrases,” including to anyone who claims to represent a wallet provider, an exchange, or a law-enforcement agency.

In practice, the checks are simple. Buy only from ledger.com or an authorised channel, confirm the packaging seal is intact, and let Ledger Live run its genuine-device check during first setup. A legitimate Ledger never asks you to type a recovery phrase into a computer or a website; the phrase is entered only on the device itself during its own initialisation. Anyone offering wallet “verification” or “recovery” help over a message is running the classic social-engineering play, and the SPF pointed residents to the ScamShield helpline at 1799 and its 24-hour police hotline for reporting.

What the advisory leaves open matters for anyone holding cold storage bought from a third party. The SPF has not identified which retailers sold the tampered units, has not said whether the Singapore devices trace back to the same supplier as the CryptoBilis implants, and has not announced a recall. Ledger’s review of the affected cases is the next concrete signal, as is any expansion of the retailer list. Until then, the prudent path is the one the police already laid out: verify the device, guard the phrase, and move assets off anything that shows a hint of tampering.