Singapore Police: Ledger Wallets Bought at Local Retailers Carried Malicious Hardware

On October 28, the Singapore Police Force warned that Ledger hardware wallets purchased from some retail stores in Singapore contained malicious hardware components able to capture recovery phrases or private keys. At least two cases have been reported since September 10, with combined losses of about S$3.5 million (around US$2.7 million). Police say they are in contact with Ledger and investigations are ongoing.

Earlier this month, Ledger confirmed an unauthorized implant in a device sold by the Malaysian reseller CryptoBilis, told that reseller to stop selling, and then asked resellers across Southeast Asia and Hong Kong to suspend sales. Ledger says the Secure Element and firmware were not modified, and its Genuine Check cannot detect hardware added alongside them. Third-party onchain estimates put related losses above US$86 million, which Ledger has not fully confirmed. Onchain tracking showed linked addresses still moving thousands of ETH into a mixer on October 29.

Where small teams are exposed

Four things you can do now

• Inventory every signing device: purchase channel, date and serial number. Anything not shipped directly by the manufacturer should stop signing; generate a new recovery phrase on a device bought direct and migrate the assets
• Write a procurement rule: signing devices are ordered only from the manufacturer's official store and shipped straight to the signer. Inspect packaging and casing on arrival; if anything looks off, do not power it on and hand it to your security lead
• Buy multisig signers' devices in separate batches through separate channels, and mix vendors where you can, so one compromised channel cannot take down the whole threshold
• Put onchain monitoring on all signer and treasury addresses with instant alerts for unexpected outflows, and write the migration runbook for a suspected tampered device in advance

Case count and losses come from the Singapore Police Force advisory. Ledger's confirmation and sales suspension come from Ledger's official statements; third-party loss estimates have not been fully confirmed by Ledger. Retailer names have not been officially confirmed and are left out. This article does not cover technical details of the implant.