Cryptocurrency investors in Singapore have lost approximately S$3.5 million ($2.7 million) after purchasing tampered Ledger hardware wallets, according to Singapore police. In an advisory issued on October 28, authorities confirmed at least two cases and said complaints began arriving on September 10 — nearly a month before the wider security breach became public in October.

Preliminary investigations found malicious components inside Ledger devices purchased from certain retail stores in Singapore. Alterations of this kind fall under what is described as a supply chain compromise, in which individual units are physically modified somewhere between manufacturing and the point of sale, rather than attacked through software after setup.

Unauthorized Hardware Captured Recovery Phrases and Private Keys

Investigators discovered that the compromised devices contained unauthorized hardware capable of capturing recovery phrases and private keys. With that information, attackers could access cryptocurrency holdings and transfer funds without the owners' permission.

Hardware wallets are designed to protect digital assets by keeping private keys offline. The Singapore incidents demonstrate how physical tampering can undermine that protection before customers even begin using their devices. Because a recovery phrase allows users to restore access to their holdings, anyone who obtains it can potentially take control of the associated wallet and move its assets — which is why the phrase itself is treated as the most sensitive credential in self-custody arrangements.

Ledger Suspends Regional Sales Amid Investigation

Ledger began investigating reports involving devices distributed through Southeast Asian reseller CryptoBilis earlier in October. On October 10, the company confirmed an unauthorized hardware implant in at least one affected device. By October 13, Ledger had requested a temporary suspension of sales through regional resellers and distributors — a precautionary measure covering Singapore, Malaysia, Indonesia, Thailand, the Philippines, Vietnam, and Hong Kong.

The company has been reviewing affected cases while cooperating with Singapore authorities, though the full scale of the suspected supply chain compromise remains uncertain. Whether additional affected units surface across the seven covered jurisdictions is among the open questions as that review continues.

Police Urge Users to Protect Remaining Assets

Singapore police advised cryptocurrency holders to stop using devices suspected of tampering, avoid entering recovery phrases, and refrain from conducting additional transactions through potentially compromised hardware.

Where credentials may have been exposed, authorities recommended moving remaining cryptocurrency to a trusted wallet with a newly generated recovery phrase, with the transfer carried out through an uncompromised device.

The case highlights growing concerns about cryptocurrency hardware wallet distribution channels, showing that even devices designed for offline security can expose investors to significant losses when attackers compromise physical products before delivery. For investors, it reinforces the importance of verifying device authenticity and following manufacturer security advisories.

Singapore police continue to investigate the reported losses as Ledger reviews the affected wallets. How many devices were affected, where in the distribution chain the tampering took place, and when regional reseller sales might resume are among the details that remain unresolved.