The Singapore Police Force said on 28 October that Ledger hardware wallets bought from some retail stores in the country had been found with malicious hardware components, after at least two reported cases produced losses totalling about S$3.5 million since 10 September. The notice matters because it moves a threat previously linked to an online reseller onto the shelves of physical stores, where a tampered unit can sit beside a genuine one and look identical to the buyer.
How the tamper defeats the design
A hardware wallet is built around a secure element, a dedicated chip that generates and stores private keys so they never reach the phone or computer the device connects to. A physical implant works around that protection from the outside. Before the unit is sold, someone opens the casing and adds or swaps a component on the circuit board, then reseals it. That extra hardware can record the recovery phrase as the owner types it during setup, or the device may arrive already loaded with a phrase the attacker generated, so deposits appear safe while the attacker keeps the keys. The police described the same effect in plain terms: the components could capture recovery phrases or private keys and let an unauthorised party move funds without the owner’s knowledge or consent.
The distinction that follows is easy to miss. This is a supply-chain compromise, not a software exploit and not a cryptographic break of the secure element. The tampering happens before the buyer ever touches the device, which is why a unit that fails a genuine-device check should never receive funds.
What buyers should actually do
The advisory is guidance, not a recall. The police told holders to follow their wallet provider’s official advisories, to avoid entering a recovery phrase or transacting on a device they suspect has been altered, and to move remaining assets to a new wallet with a freshly generated phrase on an uncompromised device if they believe a phrase or key was exposed. The standing rule is repeated in the notice: never disclose private keys or recovery phrases, including to anyone claiming to represent a wallet maker, an exchange or a law-enforcement agency.
In practice the checks are simple. Buy from the maker directly or an authorised channel, confirm the packaging seal is intact, and run the companion app’s genuine-device check during first setup, because a failed check is the clearest early sign that a unit was opened or swapped. A legitimate wallet never asks for a phrase to be typed into a website; the phrase is entered only on the device itself. Anyone messaging with offers of wallet verification or recovery help is running a familiar social-engineering play.
What the advisory leaves open
The notice does not pretend to answer everything. The police have not named the retailers, have not said whether the Singapore devices share a supplier with tampered units identified elsewhere in Southeast Asia, and have not announced a recall. Investigations are ongoing, and Ledger is reviewing the affected cases. For anyone holding cold storage bought through a third party, the sensible course is the one the police already set out: verify the device, guard the phrase, and move funds off anything that shows a sign of tampering without waiting for a recall that may never arrive.
Adapted from Singapore Police Flag Tampered Ledger Wallets After S$3.5 Million in Losses.