Singapore’s Police Force has confirmed that tampered Ledger hardware wallets sold in local retail outlets were used to steal an estimated S$3.5 million (about US$2.7 million) in cryptocurrency. The police advisory, released on Oct. 28, cites at least two reported cases dating back to Sept. 10, nearly a month before the broader Southeast Asian incident was disclosed. Preliminary forensic analysis indicates that the compromised devices contained malicious components capable of capturing users’ recovery phrases or private keys, enabling attackers to move funds without the owners’ knowledge.

Timeline and Scope of the Investigation

The police report notes that the window of investigation opens on Sept. 10, when the first local case was identified, and extends through the end of October. Ledger disclosed on Oct. 9 that it had detected wallet drains tied to devices sold through CryptoBilis, an authorized reseller operating in Indonesia, Malaysia, the Philippines and other markets. While the Singapore advisory does not confirm a direct link between the local cases and the CryptoBilis‑related drains, both incidents involve the same brand of hardware wallet and similar implant behavior. Ledger confirmed on Oct. 13 that a device purchased from CryptoBilis contained an added part that decoded the recovery phrase during setup and transmitted it over LTE. The company subsequently asked retailers in Singapore and six other Asian markets to pause sales while investigations continue.

Police Guidance for Affected Users

The Singapore Police Force (SPF) urged anyone who suspects their Ledger device has been tampered with to immediately stop entering the recovery phrase or initiating transactions. Users should contact Ledger through official support channels and consider moving any remaining assets to a new wallet generated with a fresh recovery phrase on a clean device. The advisory also warns against sharing seed phrases with anyone, including individuals claiming to represent wallet manufacturers, exchanges, or law‑enforcement agencies. The SPF provided a hotline (1800‑255‑0000) for tips and further information.

Industry Reaction and Broader Implications

Ledger described the episode as a “localized distribution attack,” emphasizing that it does not appear to be a systemic supply‑chain compromise. The company has been working with authorities and has replaced compromised devices for affected customers, as reported by users who received replacement units after contacting support. Competing hardware wallet maker Trezor announced on Oct. 13 that it would reduce the number of authorized resellers following the recent supply‑chain incidents, citing heightened security concerns. Security researcher Austin Campbell of Zero Knowledge Group used the incident to argue that self‑custody solutions should favor simpler, less attack‑surface‑prone designs.