Ledger wallets sold in Singapore stores carried malicious hardware, police say

Singapore police detected malicious hardware components in some retail-bought Ledger crypto wallets in the city-state.

At least two cases have been reported since September 10, involving losses of about S$3.5 million, or ~$2.7 million.

SPF says the components could capture recovery phrases and keys

The Singapore Police Force pointed out the devices in an advisory on Wednesday. Initial investigations found that some components could be used to capture recovery phrases or private keys.

Then unauthorized people could open the wallets and move assets without the owners’ knowledge or consent. The advisory did not name any stores.

Police are in contact with Ledger who are probing the cases that have been impacted. Their own investigation continues.

Police warned users not to enter recovery phrases and not to make transactions on devices they suspect may have been compromised.

The force also warned against handing out keys or seed phrases to anyone, including people impersonating wallet providers, exchanges or police.

Reports predate the October 9 CryptoBilis alert by about a month

The first Singapore report was filed about a month ahead of the broader incident’s public release on Oct. 9. Ledger asked on that day to stop sales and shipments from CryptoBilis, an authorized reseller in Indonesia, Malaysia and the Philippines.

At the time, Cryptopolitan reported that more than $86 million of Bitcoin, Ethereum and Tron had allegedly been stolen from the wallets the store sold. Ledger has not confirmed the sum.

Ledger said on October 10 that it had discovered an unauthorized hardware implant on one customer’s device. The chip, tucked inside the Nano X case, read the 24-word recovery phrase off the screen during setup, and sent it over a built-in SIM via LTE.

The Donjon security team at Ledger said the chip did not affect the Secure Element, operating system and signing process. And that’s why it never set off the company’s “Genuine Check” authenticity test.

In the days that followed, two Singapore claims came to light. Former Mt. Gox chief executive Mark Karpelès said he bought a Ledger Flex at the airport in Singapore that had a spy implant.

One owner said a unit purchased from local IT retailer Challenger was tampered with and Ledger later sent a replacement. Ledger requested retailers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales of its products on October 13.

In a post on Oct. 28, Ledger said all confirmed losses were on devices sold through a limited number of resellers. It has not confirmed a drain linked to a device purchased outside Southeast Asia, and sees no indication its infrastructure, systems or direct sales channel were compromised.

“Figures circulating online come from third parties and Ledger has not fully verified them,” Ledger said on Oct. 22.

Ledger’s more lasting solution is the Atom, a $849 device the company unveiled at its Op3n event in Paris on October 15. Atom will not ship until at least summer 2027, and its anti-tampering protections will not be retrofitted to Nano, Flex and Stax units already in circulation.