Singapore’s Police Force has confirmed that tampered Ledger hardware wallets sold in local retail outlets were used to steal an estimated S$3.5 million (about US$2.7 million) in cryptocurrency. The police advisory, released on Oct. 28, cites at least two reported cases dating back to Sept. 10, nearly a month before the broader Southeast Asian incident was disclosed. Preliminary forensic analysis indicates that the compromised devices contained malicious components capable of capturing users’ recovery phrases or private keys, enabling attackers to move funds without the owners’ knowledge.

Timeline and Scope of the Investigation

The police report notes that the window of investigation opens on Sept. 10, when the first local case was identified, and extends through the end of October. Ledger disclosed on Oct. 9 that it had detected wallet drains tied to devices sold through CryptoBilis, an authorized reseller operating in Indonesia, Malaysia, the Philippines and other markets. While the Singapore advisory does not confirm a direct link between the local cases and the CryptoBilis‑related drains, both incidents involve the same brand of hardware wallet and similar implant behavior. Ledger confirmed on Oct. 13 that a device purchased from CryptoBilis contained an added part that decoded the recovery phrase during setup and transmitted it over LTE. The company subsequently asked retailers in Singapore and six other Asian markets to pause sales while investigations continue.

Police Guidance for Affected Users

The Singapore Police Force (SPF) urged anyone who suspects their Ledger device has been tampered with to immediately stop entering the recovery phrase or initiating transactions. Users should contact Ledger through official support channels and consider moving any remaining assets to a new wallet generated with a fresh recovery phrase on a clean device. The advisory also warns against sharing seed phrases with anyone, including individuals claiming to represent wallet manufacturers, exchanges, or law‑enforcement agencies. The SPF provided a hotline (1800‑255‑0000) for tips and further information.

Industry Reaction and Broader Implications

Ledger described the episode as a “localized distribution attack,” emphasizing that it does not appear to be a systemic supply‑chain compromise. The company has been working with authorities and has replaced compromised devices for affected customers, as reported by users who received replacement units after contacting support. Competing hardware wallet maker Trezor announced on Oct. 13 that it would reduce the number of authorized resellers following the recent supply‑chain incidents, citing heightened security concerns. Security researcher Austin Campbell of Zero Knowledge Group used the incident to argue that self‑custody solutions should favor simpler, less attack‑surface‑prone designs.

What to Watch Next

Authorities have not yet identified the source of the malicious components, and the investigation remains ongoing. Key developments to monitor include: (1) any formal linkage between the Singapore cases and the larger CryptoBilis‑related loss estimates, which have risen to over $100 million across 335 wallets according to blockchain analytics firm Bitquery; (2) further statements from Ledger regarding the scope of the implant and any additional remediation steps; and (3) potential regulatory responses in Singapore and other Southeast Asian jurisdictions aimed at tightening hardware‑wallet supply‑chain oversight.

Sources

This article was prepared by the CoinMag newsroom from the reports listed above.