Cryptocurrency users in Singapore have lost approximately S$3.5 million after purchasing tampered Ledger hardware wallets from local retailers, prompting a police investigation into devices containing malicious components.
Summary
- Singapore police have reported approximately S$3.5 million in cryptocurrency losses across two cases involving tampered Ledger hardware wallets purchased from local retailers since September 10.
- Preliminary investigations found that the affected devices contained malicious hardware components capable of capturing users’ recovery phrases or private keys and allowing unauthorized transfers.
- Ledger suspended hardware wallet sales across several Southeast Asian markets, including Singapore, Malaysia, Indonesia, Thailand, the Philippines, Vietnam and Hong Kong, after discovering compromised devices.
- Blockchain analysts previously estimated losses linked to compromised wallets at more than US$86 million, although Ledger said it could not confirm the total amount stolen or the number of affected users.
According to an October 28 advisory from the Singapore Police Force, at least two cases involving compromised Ledger devices have been reported since September 10, with preliminary investigations finding that some wallets sold through retail stores had been physically modified to steal sensitive information.
Investigators found that the affected devices contained unauthorized hardware capable of capturing users’ recovery phrases or private keys, which could then be used to access their cryptocurrency holdings and transfer funds without permission.
Ledger hardware wallets found with malicious components
The reported losses follow an earlier investigation by Ledger into compromised devices distributed through CryptoBilis, a reseller operating in Southeast Asia.
On October 13, Ledger confirmed that hidden hardware implants had been discovered inside one of its devices after users reported cryptocurrency thefts earlier that month.
The company’s Donjon security team found that the unauthorized component could capture the 24-word recovery phrase displayed during wallet setup and transmit the information to an attacker through an LTE cellular connection.
Recovery phrases allow users to restore access to their cryptocurrency wallets. Anyone who obtains the complete phrase can potentially recreate the wallet on another device and transfer the assets it holds.
Ledger said the malicious component operated separately from the device’s Secure Element, which is designed to protect private keys, and did not require changes to the wallet’s operating system.
As previously covered by crypto.news, the compromised devices reached customers through a reseller distribution channel, with Ledger saying its own systems and direct sales channels had not been implicated in the confirmed cases.
The company confirmed an unauthorized hardware implant in one affected wallet on October 10 and began examining other reported incidents involving devices purchased through the same reseller.
Ledger suspended sales across Southeast Asia
Following the discovery, Ledger asked resellers and distributors across Southeast Asia to suspend sales and shipments of its hardware wallets while the company investigated the affected products.
The suspension, announced on October 13, covered Singapore, Malaysia, Indonesia, Thailand, the Philippines, Vietnam and Hong Kong.
Ledger initially instructed CryptoBilis to stop selling its devices after receiving reports of stolen funds from customers who had purchased wallets through the reseller.
The company advised customers who had bought Ledger devices from CryptoBilis within the previous 90 days not to initialize unused wallets. Those who had already set up their devices were encouraged to consider moving their assets to a new wallet with a newly generated recovery phrase.
According to The Straits Times, compromised devices were identified in Singapore’s retail market, including one sold at Metapod at Changi Airport and another reportedly purchased from a Challenger outlet at VivoCity.
Blockchain analysts had previously estimated that more than US$86 million had been stolen in connection with the compromised wallets, although Ledger said it could not confirm the total losses or number of affected users.
The Singapore police’s S$3.5 million figure covers the cases reported locally and is separate from the earlier regional estimate.
Ledger wallet investigation reaches European retailers
Concerns surrounding tampered Ledger devices have not been confined to Southeast Asia.
On October 13, German electronics retailer MediaMarktSaturn suspended Ledger hardware wallet sales across its physical stores and online channels after a customer in Germany reported finding an unauthorized component inside a device.
Ledger agreed to the suspension while its security team examined the reported hardware modification.
The manufacturer said no customer funds had been lost in the German incident and maintained that its infrastructure, systems and services had not been compromised.
A separate hardware wallet security incident emerged on October 26 when rival manufacturer Keystone disclosed an authentication key breach affecting its devices.
Keystone said hackers had stolen a device authentication key and exposed information belonging to 25,964 customers, forcing it to destroy 18,835 hardware wallets and temporarily suspend shipments.
Unlike the Ledger incidents, Keystone said its customers’ recovery phrases and private keys had not been compromised.
