Tampered Ledger wallets cost Singapore users $2.7M

What happened

Singapore's police force disclosed on October 29 that unauthorized hardware modifications in Ledger wallets had affected local users, with at least two cases reported since September 10 resulting in combined cryptocurrency losses of approximately 3.5 million Singapore dollars, equivalent to $2.7 million. The advisory marked the first official confirmation of losses from the broader tampered hardware wallet incident that had surfaced publicly weeks earlier.

Preliminary investigations determined that the affected devices contained malicious hardware components capable of intercepting users' 24-word recovery phrases or private keys during wallet setup. These credentials allow attackers to restore wallets on separate devices and transfer assets without authorization. The compromised devices were purchased from retail locations in Singapore, including outlets at Changi Airport and shopping centers.

The Singapore findings emerged after public reports in early October involving devices distributed through CryptoBilis, an authorized Ledger reseller operating across Indonesia, Malaysia, and the Philippines. Former Mt. Gox CEO Mark Karpelès reported discovering a spy implant in a Ledger Flex purchased at Singapore's airport, while another user identified a tampered device acquired from Challenger, a local IT retailer. Ledger subsequently issued the affected user a replacement device.

Why it matters

The Singapore police disclosure revealed that the supply chain compromise extended further back in time than previously known, with cases reported nearly a month before public awareness emerged in early October. The incident underscores vulnerability in hardware wallet distribution channels even when devices pass through authorized retailers, raising questions about the physical security of products during manufacturing and logistics.

For cryptocurrency users, the case demonstrates that hardware wallets, while generally considered more secure than software alternatives, remain subject to tampering at the point of sale if distribution channels are not adequately protected. The recovery phrases compromised in the Singapore cases cannot be regenerated once exposed, making affected wallets permanently vulnerable regardless of subsequent security measures.

Background

The malicious components operated independently from Ledger's Secure Element, the dedicated security chip designed to protect private keys, and required no modifications to the wallet's operating system. Ledger's Donjon security team determined that the unauthorized hardware could transmit captured recovery phrases through an LTE cellular connection, enabling remote theft of cryptocurrency holdings.

On October 13, Ledger announced a suspension of hardware wallet sales across seven Southeast Asian jurisdictions, Singapore, Malaysia, Indonesia, Thailand, the Philippines, Vietnam, and Hong Kong, while investigations proceeded. The manufacturer advised customers who purchased devices from CryptoBilis within 90 days to avoid initializing new wallets and recommended that existing users migrate their assets to newly generated wallets with fresh recovery phrases.

Ledger confirmed that its own systems and direct sales channels had not been compromised, with the tampering occurring through the reseller distribution network. The company stated it was collaborating with Singapore police and other authorities as investigations expanded. Blockchain analysts had estimated total losses connected to the compromised devices at over $86 million, though Ledger said it could not independently verify the total amount stolen or the number of affected users globally.

What to watch

The investigation extends beyond Southeast Asia. In October, German electronics retailer MediaMarktSaturn suspended Ledger sales after a customer discovered an unauthorized component in a device. Ledger said no customer funds were lost in that incident and maintained that its infrastructure had not been compromised.

A separate hardware wallet security breach surfaced on October 26 when rival manufacturer Keystone disclosed that hackers had stolen device authentication keys and exposed information for approximately 26,000 customers, forcing the company to destroy over 18,000 hardware wallets. Unlike the Ledger incidents, Keystone stated that customer recovery phrases and private keys had not been compromised in the breach.

Questions readers ask