Singapore authorities have launched an investigation after discovering that some Ledger hardware wallets sold at local retailers contained malicious hardware capable of stealing users’ recovery phrases and private keys. The Singapore Police Force reported on October 28 that at least two cases have been recorded since September 10, with combined losses of approximately S$3.5 million ($2.7 million).
According to investigators, the compromised devices were physically modified to include unauthorized components that could capture sensitive wallet setup data and transmit it to attackers via an LTE cellular connection. The malicious implant operated separately from Ledger’s Secure Element, meaning the core security chip was not altered, but users’ 24-word recovery phrases could still be intercepted during initialization.
Ledger confirmed on October 13 that its Donjon security team found a hidden hardware implant inside one device after users reported thefts earlier that month. The company linked the tampered products to CryptoBilis, a reseller operating in Southeast Asia, and asked distributors across Singapore, Malaysia, Indonesia, Thailand, the Philippines, Vietnam and Hong Kong to suspend sales and shipments. Ledger also advised customers who purchased devices from CryptoBilis within the previous 90 days not to initialize unused wallets, and urged those who had already set up wallets to move assets to new wallets with newly generated recovery phrases.
Local reports identified compromised devices at Metapod at Changi Airport and a Challenger outlet at VivoCity. Blockchain analysts previously estimated losses linked to compromised wallets at more than US$86 million, though Ledger said it could not confirm the total amount stolen or the number of affected users. The Singapore police’s S$3.5 million figure covers locally reported cases and is separate from that regional estimate.
Concerns extended beyond Southeast Asia when German electronics retailer MediaMarktSaturn suspended Ledger hardware wallet sales across physical and online channels after a customer found an unauthorized component. Ledger said no customer funds were lost in the German incident and that its infrastructure, systems and services had not been compromised. In a separate incident on October 26, rival hardware wallet maker Keystone disclosed an authentication key breach affecting 25,964 customers, forcing it to destroy 18,835 wallets, but said recovery phrases and private keys were not compromised.
The events raise serious questions about hardware wallet supply-chain security, particularly for devices sold through third-party retailers, and could push manufacturers toward stricter quality controls, tamper-evident packaging and expanded security audits.
