Singapore police warn of tampered Ledger wallets after losses
Singapore police warned on October 28, 2026, that tampered Ledger hardware wallets purchased from retail stores in the country had been linked to at least two reported cases since September 10, with total losses reaching about $3.5 million.
Preliminary investigations found malicious hardware components capable of capturing recovery phrases or private keys, which could give unauthorized people access to wallets and allow them to transfer assets. Police said they were in contact with Ledger, which was reviewing the affected cases. Investigations remain ongoing.
The advisory tells users to stop entering recovery phrases or making further transactions on devices they suspect have been tampered with. Where keys may have been compromised, police recommend considering a transfer of remaining assets to a trusted wallet with a newly generated recovery phrase, using an uncompromised device.
How the implant works
Ledger described the mechanism in an October 13 statement from its official account. Its Donjon security team found an implant inside the enclosure that reads data shown on the device's screen. During setup, the device displays the 24-word recovery phrase. The implant's microcontroller decodes those words and transmits them over LTE through a provisioned eSIM.
Ledger said the attackers bought genuine devices, opened them, fitted hidden components and put them back into distribution through Southeast Asian resellers. The company described an operation prepared over many months, with infrastructure for collecting seed phrases, draining wallets and laundering proceeds.
Attack scope and response
Ledger identified CryptoBilis, a Southeast Asian reseller, as the source of devices connected to all fund losses in the incident disclosed on October 9. The company confirmed an unauthorized implant in one affected user's device on October 10. MediaMarkt Saturn had also stopped selling Ledger devices in Germany after a customer reported an implant, though no funds were lost in that case.
Ledger asked authorized resellers and distributors to suspend sales in Southeast Asia and Hong Kong. The company reminded its authorized network that returned devices could never be resold in any form, even if they appeared new and unopened. New handling requirements took effect immediately, requiring retailers to keep stock in the back and hand it over at purchase.
User guidance
Ledger's instructions distinguish between unused devices and wallets already set up. Buyers who have not initialized a device should leave it unset and contact support. Those who have should transfer assets promptly to a new device with a new recovery phrase. Ledger specifically warns against entering or restoring any recovery phrase on a device bought from CryptoBilis.
People who lost funds or hold a tampered device should contact official support and file a local police report. They should not send the device to anyone before speaking with support or law enforcement. The police warning also extends to recovery scams, reminding users that Ledger will never call users or ask for their recovery phrase.
Related
