2nd November, 2026
By Shubhii Verma
Singapore police are investigating S$3.5 million in cryptocurrency losses involving tampered Ledger hardware wallets purchased from local retailers. At least two cases have been reported since September 10, according to a police advisory issued October 28.
How Tampered Ledger Wallets Exposed Users’ Recovery Phrases
Investigators found that affected devices contained unauthorized hardware capable of capturing recovery phrases or private keys. Criminals could use these details to access victims’ wallets and transfer cryptocurrency.
The investigation follows discoveries of compromised devices distributed through a Southeast Asian reseller.
Ledger’s security team previously identified a hidden implant capable of capturing the 24-word recovery phrase displayed during wallet setup and transmitting it to attackers through an LTE connection. The component reportedly operated separately from the device’s Secure Element, designed to protect private keys.
Ledger Suspends Hardware Wallet Sales Across Southeast Asia
Following the discovery, Ledger suspended sales through resellers across Singapore, Malaysia, Indonesia, Thailand, the Philippines, Vietnam, and Hong Kong. Customers who purchased devices through the implicated reseller were advised not to initialize unused wallets. Existing users were encouraged to move funds to a new wallet with a freshly generated recovery phrase.
Crypto Losses Linked to Compromised Ledger Wallets May Exceed $86 Million
Blockchain analysts have estimated losses connected to compromised devices could exceed US$86 million. Ledger said it could not confirm the total stolen or the number of affected customers. Singapore’s S$3.5 million figure relates to reported local cases, not the wider regional estimate.
The incidents highlight risks associated with buying hardware wallets through unauthorized retail channels. A device may appear genuine while containing modifications that compromise information during setup.
Blockwind News ANALYSIS
The Singapore cases expose a weakness in crypto self-custody: hardware security depends not only on a wallet’s design, but also on supply-chain integrity. Encryption cannot protect users if malicious components capture recovery phrases before assets are secured.
The incident challenges the assumption that hardware wallets are automatically safe. Protection depends on trusted sourcing, tamper detection, secure initialization, and careful handling of recovery phrases. Buyers should use authorized sellers, inspect packaging, and never share recovery phrases with websites or support personnel.
Ledger’s regional sales suspension is a necessary precaution, but customers need guidance to identify affected devices and migrate funds safely. Anyone suspecting compromise should create a replacement wallet on a trusted device with a new recovery phrase; resetting a tampered device may not remove the threat.
For the industry, supply-chain security deserves as much attention as blockchain security. Trust in self-custody will depend on transparent distribution, independent audits, and rapid incident response, not hardware branding alone, as investigations continue.
