Cryptocurrency users in Singapore have lost approximately S$3.5 million after purchasing tampered Ledger hardware wallets from local retail stores, the Singapore Police Force said in an advisory published on October 28. Police said two cases involving devices made by the Paris-based company have been reported since September 10, and that the affected units contained hidden hardware capable of capturing users' recovery phrases or private keys.

A hardware wallet is a physical device that stores private keys offline, and is generally considered safer than keeping keys online, where they may be vulnerable to hacking. The cases in Singapore highlight a different attack surface: because the devices were altered before sale, the compromise did not depend on the keys being stored online, and what mattered in these cases was where each device had been bought.

Hidden Hardware Found Inside Devices

Early investigations found that some Ledger wallets sold at certain Singapore retail stores contained malicious hardware. Police said these concealed components could capture users' recovery phrases or private keys. Armed with that information, attackers could gain access to victims' cryptocurrency wallets and move funds without the owners' knowledge or consent.

Police said they are in contact with Ledger, which is reviewing the affected cases. According to The Straits Times, one compromised device was sold at Metapod at Changi Airport, while another was reportedly bought from a Challenger outlet at VivoCity.

The cases follow an earlier probe by Ledger into devices sold through CryptoBilis, a reseller in Southeast Asia. On October 10, Ledger confirmed the presence of a hidden hardware implant in one wallet. The company's Donjon security team found that the implant could capture the 24-word recovery phrase displayed during device setup and transmit the data to an attacker over an LTE cellular connection.

Ledger said the malicious component worked separately from the Secure Element, the chip that protects private keys, and that the company's own systems and direct sales channels were not involved. The tampered devices described by police and by Ledger were all bought through third-party retail or reseller channels.

Singapore Police Say Ledger crypto Wallets Sold at Local Retailers Contained Malicious Hardware Implants Singapore police said on October 28 that some Ledger cryptocurrency hardware wallets purchased from local retailers contained malicious hardware implants capable of stealing… pic.twitter.com/RckYdTzFMq

— Wu Blockchain (@WuBlockchain) October 29, 2026

Ledger Halts Sales in Seven Markets

On October 13, Ledger asked resellers and distributors to stop selling and shipping its wallets in Singapore, Malaysia, Indonesia, Thailand, the Philippines, Vietnam and Hong Kong. The company advised customers who purchased devices from CryptoBilis within the previous 90 days not to set up unused wallets, and encouraged those who had already activated their devices to move funds to a new wallet with a new recovery phrase.

Blockchain analysts have estimated total losses tied to the compromised wallets at more than US$86 million, a figure Ledger has not confirmed. The company said it could not verify the total or the number of people affected. The S$3.5 million cited by Singapore police covers only local cases.

The issue has also surfaced in Europe. On October 13, German retailer MediaMarktSaturn paused Ledger sales after a customer found an unauthorized component inside a device. Ledger said no funds were lost in that case.

In a separate incident, rival wallet maker Keystone disclosed a breach on October 26 that exposed data from 25,964 customers. Keystone said recovery phrases and private keys remained safe, but the company destroyed 18,835 wallets and paused shipments.

Singapore police said investigations are ongoing. They urged cryptocurrency users to follow official advisories from wallet makers and to never share private keys, recovery phrases or seed phrases. Anyone with information can call the police hotline at 1800-255-0000 or submit details online at www.police.gov.sg/i-witness. With the police investigation and Ledger's review ongoing, official advisories from the company and Singapore authorities remain the reference point for updated guidance in the region.