Singapore authorities have issued a formal warning after discovering that tampered Ledger hardware wallets sold through retail channels in the country led to at least S$3.5 million (US$2.7 million) in stolen cryptocurrency.
According to the Singapore Police Force (SPF), malicious components were embedded inside certain Ledger devices purchased from physical stores, enabling attackers to capture users’ recovery phrases and drain their wallets without detection.
Singapore’s proceeding shows one of the most serious hardware‑based crypto thefts reported in Southeast Asia and highlights the growing risks associated with supply‑chain manipulation in consumer crypto security products.
Serious Security Breach Hidden Inside Retail Hardware
The SPF advisory, published on 28 October 2026, confirmed that at least two victims reported losses totaling S$3.5 million after using Ledger wallets purchased from local retail stores.
Preliminary investigations revealed that the devices contained malicious hardware implants capable of reading and transmitting users’ recovery phrases or private keys. Once the attacker obtained these credentials, they were able to transfer all assets out of the victims’ wallets without their knowledge.
The discovery is significant because it shows that compromised devices reached consumers through legitimate‑looking retail channels, not just unverified online sellers. Affected units were found in stores including Changi Airport and Challenger, one of Singapore’s largest electronics retailers.
The tampering was sophisticated enough to bypass Ledger’s secure‑element architecture, which is designed to keep private keys isolated from external systems.
Instead of attacking the secure element directly, the implant intercepted the recovery phrase displayed during setup; a moment when users are most vulnerable.
How Did the Attack Work?
Ledger’s Donjon security team previously described how attackers modified genuine devices after they left Ledger’s manufacturing control.
According to Ledger’s October 13 statement, attackers purchased legitimate units, opened them, installed hidden components, and re‑sealed the devices before distributing them through Southeast Asian retail channels.
The implant included:
- A microcontroller capable of reading the 24‑word recovery phrase displayed on the device
- A covert communication module (including LTE connectivity via a provisioned eSIM)
- Firmware designed to transmit the captured recovery phrase to attacker‑controlled servers
Once the victim set up the wallet and wrote down the recovery phrase, the implant silently transmitted the phrase to the attacker, who then drained the wallet at a later time.
This sophisticated method bypasses Ledger’s secure element entirely by attacking the device’s physical interface rather than its cryptographic protections.
Small Problem Expands into a Global Financial Hub
The tampered‑hardware issue first surfaced publicly on 9 October 2026, when users in Indonesia, Malaysia, and the Philippines reported unauthorized transfers after purchasing Ledger devices from CryptoBilis, an authorized reseller.
Ledger confirmed that CryptoBilis‑linked devices contained unauthorized implants.
However, the Singapore advisory indicates the first official confirmation that compromised devices reached buyers through brick‑and‑mortar retail stores in a major financial hub. This significantly widens the scope of the problem and suggests that attackers infiltrated multiple distribution channels: not just a single reseller.
The involvement of mainstream retailers such as Changi Airport duty‑free shops and Challenger indicates that the tampered devices were circulating far beyond niche crypto communities.
Former Mt. Gox CEO Mark Karpelès also reported purchasing a tampered Ledger Flex device at Changi Airport, further validating concerns that compromised units were sold through high‑traffic retail environments.
