Singapore Warns Crypto Investors After S$3.5 Million Lost Through Ledger Wallets

Highlights:

• Ledger wallets have been compromised in at least two cases in Singapore, resulting in losses of S$3.5 million, according to the police.
• Ledger has been found to have concealed hardware within some of its devices that may be able to steal away recovery phrases and access cryptocurrency.
• Ledger stated that its systems were not compromised, and urged regional resellers to temporarily stop selling hardware wallets.

Singapore police have reported at least two cases involving tampered Ledger cryptocurrency hardware wallets, with losses totalling about S$3.5 million. Investigators found malicious parts inside some devices sold at local retail stores. The parts could steal information needed to access the owners’ crypto funds.

The Singapore Police Force disclosed the cases in an October 28 official advisory. It said the incidents had been reported since September 10, 2026. Police have contacted Ledger, which is reviewing the affected cases as the investigation continues.

Singapore Police Say Ledger crypto Wallets Sold at Local Retailers Contained Malicious Hardware Implants

Singapore police said on October 28 that some Ledger cryptocurrency hardware wallets purchased from local retailers contained malicious hardware implants capable of stealing… pic.twitter.com/RckYdTzFMq

— Wu Blockchain (@WuBlockchain) October 29, 2026

Tampered Ledger Wallets Could Steal Recovery Phrases

Singapore police found that some Ledger wallets sold at local stores had hidden parts inside them. Investigators believe these parts could steal a user’s recovery phrase or private keys during use. With those details, scammers could access the wallet and steal the crypto without needing the device again.

Police have not named the stores that sold the affected wallets or revealed how much each victim lost. They are still trying to find out who added the hidden parts and how the wallets ended up in stores. So far, police have not reported any arrests, and they continue to investigate the cases.

Ledger Says Attack Targeted Devices After Distribution

The police warning follows Ledger’s own investigation into hardware implants discovered in devices sold through resellers in Southeast Asia. In an October 15 security update, Ledger said attackers had purchased genuine wallets, opened them and installed hidden components designed to collect recovery phrases during setup. Attackers then placed the modified devices back into reseller distribution channels.

Ledger said attackers did not compromise its chips, operating system or servers. The company described the incident as an attack on its distribution channel after the products left its control, rather than a breach of its core systems. 

As a precaution, Ledger asked authorized resellers and distributors to suspend sales in Southeast Asia and Hong Kong. It also introduced stricter retail handling rules. Dealers were told not to resell returned devices, even if the packaging appeared unopened. Ledger said it was working with law enforcement and security researchers to investigate the attacks.

Police Urge Crypto Holders to Check Wallet Security

Singapore police urged crypto users to follow updates from their wallet providers. They also advised anyone who suspects someone has tampered with their Ledger wallet to stop using it immediately. Users should not use these devices to enter recovery phrases or make transactions. Those who believe someone has stolen their wallet details should move their remaining crypto to a new wallet with a fresh recovery phrase, using a secure device. 

Police also cautioned users not to share their recovery terms with anyone, even those claiming to be representatives of Ledger, crypto exchanges, or law enforcement. They warned individuals not to deal with anyone claiming to be able to recover or verify their wallets. Those with information about the cases may contact police officers through the police hotline or the police’s online reporting platform.