Singapore authorities have identified malicious hardware components inside Ledger cryptocurrency wallets purchased from retail channels in the city-state, according to an advisory issued by the Singapore Police Force (SPF) on Wednesday. At least two cases have been reported since September 10, involving combined losses of approximately S$3.5 million, or roughly $2.7 million.

The finding strikes at the core premise of hardware wallets, which are built to keep the private keys controlling cryptocurrency holdings offline, with a recovery phrase — the word sequence that can restore a wallet on a new device — serving as the master backup to those keys. Preliminary investigations found that some of the components could be used to capture recovery phrases or private keys, enabling unauthorized individuals to open the wallets and move assets without the owners' knowledge or consent. The advisory did not name any specific stores.

Police said they are in contact with Ledger, which is probing the affected cases, while the force's own investigation continues.

SPF urges caution with recovery phrases

In the advisory, the SPF warned users not to enter recovery phrases or make transactions on devices they suspect may have been compromised. The force also cautioned against handing keys or seed phrases to anyone, including individuals impersonating wallet providers, exchanges, or police officers.

Singapore reports predate the October 9 alert by about a month

The first Singapore report was filed roughly a month before the broader incident became public on Oct. 9, when Ledger asked CryptoBilis, an authorized reseller operating in Indonesia, Malaysia, and the Philippines, to halt sales and shipments.

At the time, Cryptopolitan reported that more than $86 million in Bitcoin, Ethereum, and Tron had allegedly been stolen from wallets sold by the store. Ledger has not confirmed that figure.

On October 10, Ledger said on X that it had discovered an unauthorized hardware implant on one customer's device. The chip, concealed inside the case of a Nano X, read the 24-word recovery phrase off the screen during setup and transmitted it over a built-in SIM via LTE.

Ledger's Donjon security team stated that the chip did not affect the Secure Element, the operating system, or the signing process, which is why it never triggered the company's "Genuine Check" authenticity test.

In the days that followed, two Singapore-related claims came to light. Mark Karpelès, former chief executive of Mt. Gox, said he bought a Ledger Flex at a Singapore airport that contained a spy implant. Another owner reported that a unit purchased from local IT retailer Challenger had been tampered with, and Ledger later sent a replacement.

On October 13, Ledger requested retailers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend sales of its products.

In a post on Oct. 28, the company said all confirmed losses involved devices sold through a limited number of resellers. It has not confirmed any drain linked to a device purchased outside Southeast Asia and sees no indication that its infrastructure, systems, or direct sales channel were compromised.

"Figures circulating online come from third parties and Ledger has not fully verified them," the company said on Oct. 22.

Ledger's longer-term answer: Atom

Ledger's more lasting solution is the Atom, an $849 device the company unveiled at its Op3n event in Paris on October 15. Atom will not ship until at least summer 2027, and its anti-tampering protections will not be retrofitted to Nano, Flex, and Stax units already in circulation. Until the police inquiry and Ledger's probe conclude, any future advisory naming the stores involved would be the clearest signal yet for owners trying to determine whether their devices fall within the affected retail channels.