Quick answer: Tampered Ledger wallets bought from some Singapore retail stores contained hidden components that stole recovery phrases, the Singapore Police Force said on Oct. 28, 2026. At least two cases have been reported since Sept. 10, with losses of about S$3.5 million (roughly $2.7 million).
Tampered Ledger wallets sold in Singapore shops have now been linked to about S$3.5 million in stolen crypto. The Singapore Police Force (SPF) said in an advisory on Oct. 28, 2026 that at least two cases have been reported since Sept. 10.
The devices looked genuine, but hidden hardware inside quietly copied each owner’s recovery phrase. Here is what police and Ledger have confirmed, and how to check whether your own wallet is at risk.
What did Singapore police say about tampered Ledger wallets?
According to the SPF, preliminary investigations found that Ledger hardware wallets bought from “some retail stores in Singapore” contained malicious hardware components. These parts could capture recovery phrases or private keys, so attackers could move funds without the owner’s knowledge.
Police said they are in contact with Ledger, which is reviewing the cases, and that investigations are ongoing. Losses total about S$3.5 million, which Cointelegraph puts at roughly $2.7 million. Notably, the first local report on Sept. 10 came almost a month before the wider incident became public on Oct. 9.
How does the hardware implant steal recovery phrases?
Ledger’s security lab, the Donjon, took the implant apart. In a post on X, Ledger said the implant sits inside the case and reads what the screen shows. During setup, the device displays the 24-word recovery phrase. The implant decodes those words and sends them out over a mobile (LTE) connection using a built-in eSIM.
Importantly, the implant is a separate part. It does not change the Secure Element chip, the operating system, or any transaction. As a result, Ledger’s built-in genuineness checks cannot detect it, as BleepingComputer explained.
Where did the tampered devices come from?
The attack surfaced on Oct. 9, 2026, when users reported drained wallets after buying devices through CryptoBilis, a Southeast Asian reseller. Ledger said all confirmed fund losses at that point involved CryptoBilis devices. However, Singapore police now point to devices from local retail stores, and Ledger says it is reviewing reports from other locations.
On Oct. 13, Ledger asked resellers in Singapore, Malaysia, Indonesia, Thailand, the Philippines, Vietnam and Hong Kong to pause sales, per The Straits Times. The same report cites blockchain analysts estimating total losses above $86 million. Ledger says it has not verified any total figure.
In its Oct. 15 response, Ledger called it an attack on the distribution channel, not on its chip or servers. It also told resellers to keep devices off shelves and never resell returned units.
How can you check if your Ledger is safe?
Police and Ledger give similar advice:
- Check where you bought it. If it came from CryptoBilis or a suspect shop, do not set it up. Contact Ledger Support through official channels.
- Already set up? Move your funds to a new, trusted wallet with a newly generated recovery phrase, on a device you trust.
- Never type your recovery phrase into a website, app or form. Ledger says it will never call you or ask for your 24 words.
- Buy direct. Order from the maker or an authorized reseller, and be wary of open or “like new” boxes.
If you need a refresher on safe backups, read our seed phrase guide. This also follows other hardware wallet scares, such as the Keystone data breach and fake Foundation Passport emails.
What does this mean for crypto self-custody?
Hardware wallets remain one of the safest ways to hold Bitcoin and other coins. Still, this case shows the supply chain is a weak point. Because the implant reads the screen, even a genuine chip cannot protect a phrase that leaks during setup. Therefore, expect more wallet makers to add tamper checks, and expect buyers to favor direct orders.
Tampered Ledger Wallets FAQ
How much was lost to tampered Ledger wallets in Singapore?
The Singapore Police Force said on Oct. 28, 2026 that at least two cases since Sept. 10 caused losses of about S$3.5 million, roughly $2.7 million per Cointelegraph.
Was Ledger itself hacked?
No. Ledger says its Secure Element chip, operating system and servers were not compromised. Criminals opened genuine devices, added a hidden implant and put them back into resale channels in Southeast Asia.
How do I know if my Ledger has an implant?
Ledger’s own checks cannot spot this implant. The main risk sign is where you bought it: CryptoBilis or an unofficial or suspect store. If unsure, move funds to a new wallet with a new recovery phrase.
Should I stop using a Ledger hardware wallet?
Not necessarily. Devices bought directly from Ledger have no confirmed losses tied to this attack. The issue is tampered units in resale channels, so the source of your device matters most.
Not financial advice. Do your own research (DYOR) before making any investment decision.
Sources
- Singapore Police Force: Police Advisory on Tampered Cryptocurrency Hardware Wallets (Oct. 28, 2026)
- Ledger: Response to the Hardware Implant Attack (Oct. 15, 2026)
- Ledger on X: Donjon update on the CryptoBilis investigation
- The Straits Times: About $3.5m lost in Singapore due to tampered Ledger wallets
- Cointelegraph: Tampered Ledger wallets cost Singapore users $2.7M
- BleepingComputer: Ledger asks sellers across Asia to halt sales
