Singapore police have recorded at least two cases involving tampered Ledger hardware wallets since Sept. 10, with combined losses of about 3.5 million Singapore dollars ($2.7 million) — placing local reports nearly a month before the wider incident became public.

In an advisory published Wednesday, the Singapore Police Force said preliminary investigations found malicious hardware components in Ledger wallets purchased from some retail stores in Singapore. Hardware wallets are designed to keep the private keys that control cryptocurrency holdings offline, and the advisory's findings concern the physical devices themselves rather than an online account or software compromise.

The disclosure adds both a local loss figure and an earlier reporting date to the incident, which surfaced publicly on Oct. 9 following reports of losses involving devices sold through CryptoBilis, an authorized Ledger reseller in Indonesia, Malaysia and the Philippines.

Days later, former Mt. Gox CEO Mark Karpelès said in a post on X that a Ledger Flex purchased at Singapore's airport contained a spy implant.

Another Ledger user claimed on X to have a tampered device bought from local IT retailer Challenger, and said Ledger later sent him a new device. Taken together, the reports to date span an authorized regional reseller, an airport purchase and a local IT retailer, indicating the affected channels cut across mainstream retail rather than a single source.

On Oct. 13, Ledger said it had asked retailers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend sales of Ledger devices as investigations are ongoing.

Singapore police said it is in contact with Ledger, which is reviewing the affected cases, while police investigations are ongoing. With both the police investigation and the company's review still open, the full scope of affected devices and retail channels remains to be established.

Related: Ledger's early implant warnings deserved more action, Karpelès says