Cryptocurrency users in Singapore have lost approximately $3.5 million following the compromise of physically tampered Ledger hardware wallets. The Singapore Police Force (SPF) confirmed that at least two cases have been reported since September 10, 2026, involving compromised devices purchased from local retail stores.
Hardware Implants Intercept Private Keys
Preliminary investigations by the SPF revealed that select Ledger devices sold through Singaporean retail outlets contained unauthorized hardware implants. These malicious components were engineered to steal seed phrases and private keys, allowing attackers to drain funds without user authorization. French manufacturer Ledger is currently reviewing the reported incidents alongside Singaporean authorities.
The SPF advised affected users to immediately cease entering recovery phrases on suspicious devices, halt all ongoing transactions, and contact official support channels. Furthermore, the police emphasized that security credentials should never be shared with third parties, including individuals claiming to work for wallet providers or law enforcement agencies.
Key Takeaways:
- Singapore Police Force confirmed $3.5 million in losses across at least two cases since September 10, 2026.
- Malicious hardware implants inside retail-bought Ledger devices were used to steal recovery phrases.
- Analytics firm Bitquery previously linked hardware tampering at regional reseller CryptoBilis to $102 million in losses across 335 wallets on five blockchains.
Broader Supply Chain Risks Hit Southeast Asia
The Singapore disclosures follow an ongoing investigation into regional reseller CryptoBilis, which operates across Indonesia, Malaysia, and the Philippines. Earlier this month, CryptoBilis confirmed finding an unauthorized hardware implant in a customer's wallet. While initial reports cited over $80 million in damages, blockchain analytics firm Bitquery subsequently estimated total losses at $102 million across 335 wallets spanning five blockchains.
In response, Ledger directed CryptoBilis to halt sales of its entire hardware wallet inventory. Ledger stated there is no evidence that its own systems or security infrastructure were compromised. Unverified reports on social platform X have also surfaced regarding a device allegedly purchased from European retailer MediaMarkt. While physical tampering differs from digital vulnerabilities seen in major crypto exchange exploits, both highlight critical attack vectors in digital asset custody.
Why It Matters
The discovery of hardware-level supply chain attacks undermines one of the foundational security assumptions in the cryptocurrency industry: that cold storage hardware wallets are inherently immune to remote theft. While software vulnerabilities and smart contract exploits are common, hardware tampering forces users to audit physical distribution pipelines before trusting offline devices. Moving forward, manufacturers may need to implement cryptographic supply chain verification protocols to ensure device integrity before hardware reaches retail shelves.
