Singapore Police Reveal: At Least Two Cases of Physical Tampering with Ledger Hardware Wallets Resulting in Losses of Approximately S$35 Million

According to Coin Circle (120BTC.COm), on October 28, Beijing time, the Singapore Police Force (SPF) issued a special security warning, reporting on serious physical tampering theft cases involving the globally mainstream cryptocurrency hardware wallet Ledger. Official data shows that since receiving the first related report on September 10, 2026, at least two major asset theft cases have been established locally, with victim investors incurring cumulative losses equivalent to approximately S$35 million.

Preliminary judicial investigations indicate that the involved hardware was not compromised through remote network intrusion, but rather that some devices circulated in offline retail stores in Singapore were disassembled and physically modified after leaving the factory. Malicious hardware components not from the original manufacturer were covertly implanted inside the devices. When investors follow standard guidelines to unbox and initialize or input recovery phrases (mnemonic phrases) and private keys during subsequent transaction interactions, the additional chip records all plaintext data, allowing unauthorized attackers to gain control and transfer assets in the background. The SPF has now fully initiated cross-border law enforcement cooperation and officially notified Ledger's original manufacturer to conduct a special technical investigation.

Manufacturer Urgently Suspends Retail Supply Chains in Multiple Countries

From the perspective of the attack path, this security incident has broken through the traditional boundaries of firmware defects or software vulnerabilities, evolving into a typical supply chain physical attack. In the common knowledge of blockchain asset custody, hardware cold wallets rely on "private keys never touching the internet" as a security foundation; however, once physical devices are equipped with hardware sniffing chips during the delivery chain, the offline isolation mechanism loses its defensive effectiveness. Even if victims generate mnemonic phrases in a completely offline environment, relevant sensitive parameters can still be captured and retained by malicious components while being displayed on the screen or processed by the microprocessor.

To prevent potentially damaged unopened devices from continuing to flow into the consumer market, according to reports from The Straits Times citing industry sources, Ledger has taken urgent risk avoidance measures and officially suspended retail sales in Southeast Asia and Hong Kong. The restricted jurisdictions comprehensively cover key markets including Singapore, Malaysia, Indonesia, Thailand, the Philippines, Vietnam, and Hong Kong, China. This move aims to completely block third-party distribution channels that may have encountered batch infiltration and to conduct thorough hardware integrity audits on existing stock before the official investigation conclusions are clear.

Blocking Supply Chain Side Recording and Secondary Asset Loss

For users who currently own or have recently purchased similar devices, the Singapore police have issued four key disposal guidelines to cryptocurrency asset holders, urging market participants to complete device compliance checks as quickly as possible:

• Track official dynamic information sources: Closely follow the official warning memorandums and hardware anti-counterfeiting verification schemes published by device manufacturers and law enforcement agencies, avoiding reliance on interpretations from unofficial channels;

• Immediately stop losses and cut off interactions: If there are doubts about the integrity of the hardware being used, immediately cease inputting mnemonic phrases or signing any on-chain transactions, and directly contact the manufacturer's technical support for in-depth verification;

• Completely reconstruct asset channels: If there is suspicion of leakage of private keys or recovery phrases, quickly generate a new mnemonic phrase address system using confirmed unaltered secure devices, and physically migrate all remaining on-chain assets;

• Strictly maintain the confidentiality of private keys: Under no circumstances should core mnemonic phrases be disclosed to any third party, and remain vigilant against phishing attempts disguised as official customer service, exchange certification, or judicial authorities requesting "verification of cold wallets" or "assistance in recovery."

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.