Singapore police have warned that some Ledger cryptocurrency hardware wallets sold through local retailers contained malicious hardware implants capable of stealing users’ recovery phrases or private keys.

At least two cases reported since September 10 have resulted in combined losses of approximately S$3.5 million ($2.7 million), according to a police statement issued on October 28, 2026. Ledger is reviewing the reported incidents, while police investigations remain ongoing.

The warning concerns Ledger devices purchased through local retail channels. Authorities have not publicly established how the devices were modified or how they entered the retail supply chain, and they have not announced the full scope of the incidents or identified all potentially affected devices. Until those facts are made public, buyers have no official reference for confirming whether a specific device is implicated.

Ledger is a French company known for manufacturing hardware wallets that help users store cryptocurrency private keys offline. Such devices are widely used by people seeking greater control over their digital assets — a model known as self-custody, in which individuals hold their own keys rather than relying on exchanges or other third parties to safeguard funds. The reported cases, however, highlight the risks that physical tampering and supply-chain attacks, in which products are compromised between manufacture and end use rather than on a user’s computer, can pose even when users believe they are using a secure hardware wallet.

How Malicious Hardware Implants Can Compromise Wallets

Hardware wallets are designed to keep sensitive information separate from internet-connected devices. A malicious implant could undermine those protections by compromising a device’s ability to protect recovery phrases or private keys.

A recovery phrase is a series of words that allows a user to restore access to a cryptocurrency wallet. Anyone who obtains the phrase may be able to access the associated digital assets without the owner’s permission, making recovery phrase security a critical safeguard.

The reported losses demonstrate the potential cost of a compromised wallet. However, the incidents do not establish that all Ledger devices are vulnerable or that Ledger’s standard hardware security systems have been broadly compromised. Singapore police’s warning specifically concerns certain devices purchased through local retailers.

Singapore Police Say Ledger crypto Wallets Sold at Local Retailers Contained Malicious Hardware Implants Singapore police said on October 28 that some Ledger cryptocurrency hardware wallets purchased from local retailers contained malicious hardware implants capable of stealing… pic.twitter.com/RckYdTzFMq — Wu Blockchain (@WuBlockchain) October 29, 2026

The related post is available at and https://x.com/WuBlockchain/status/2115679105505231344?ref_src=twsrc%5Etfw.

Guidance for Ledger Users

Following the alert, cryptocurrency holders are being urged to pay close attention to where they purchase hardware wallets. Buying directly from the manufacturer or an officially authorized seller can reduce supply-chain risks, although it cannot eliminate every threat. Users should also follow the manufacturer’s official setup and authenticity-check procedures.

Recovery phrases should never be entered into websites, shared with customer support representatives or stored in unsecured online accounts. Anyone who suspects that a device has been physically modified should stop using it and seek guidance through Ledger’s official support channels.

If a recovery phrase may already have been compromised, transferring funds to a newly generated wallet using a trusted device may be necessary. Ledger is reviewing the affected cases, while Singapore police continue their investigation.

The incidents serve as a reminder that physical device security is as important as protecting cryptocurrency accounts online. How the devices were altered, how they entered the retail supply chain, and how many units may be affected remain open questions, with further police advisories or findings from Ledger’s review the channels through which those details would be made public. As investigators examine the reported losses, users are being advised to treat wallet authenticity and recovery phrase protection as essential safeguards.

Source: https://coinomedia.com/ledger-wallet-security-alert/