hack or exploit

Tampered Ledger wallets cost Singapore users $2.7M: Police

11Importance
closedStatus
7News media
8Pieces
Published
Updated
Since then
7 new reports

Singapore police said tampered Ledger hardware wallets sold through local stores were tied to at least two reported cases starting Sept. 10, with losses estimated at about S$3.5 million. New coverage also notes that Ledger issued a public alert on Oct. 9, while police warned the suspected hardware could capture recovery phrases and private keys.

Key claims & sources

✓
✓
Singapore police said some Ledger hardware wallets sold through local stores contained malicious hardware components.
✓
Police said at least two cases had been reported since Sept. 10, with total losses of about S$3.5 million, or about $2.7 million.
✓
Police said the suspicious components could capture recovery phrases and private keys.

What it means

Ledger's hardware wallets are marketed as the gold standard for cold storage, keeping private keys offline and away from browser-based exploits. That security model assumes the device itself is untouched between factory and owner. Singapore's case follows a known attack vector: wallets bought through local retailers rather than Ledger's own store, where a device can be opened, seeded with a pre-known recovery phrase, and resealed before it ever reaches a customer.

Owners who bought from unauthorized Singapore retailers now face a hard choice: treat any device not bought direct from Ledger as compromised and move funds to a freshly generated wallet with a seed phrase created in their own presence. Retailers who stocked tampered units face scrutiny and possible liability as police widen the inquiry. The jump from S$2.7 million to S$3.5 million in losses shows the investigation is still finding victims, not closing the book.

Hardware wallets exist to remove trust from software and exchanges, but this case moves the point of failure to the supply chain instead. A device can be cryptographically sound and still be a trap if someone intercepts it before sale. That undercuts the clean pitch of self-custody: security here depends not just on code but on where you bought the box, a retail-trust problem crypto was supposed to design away. (per thedefiant.io)

Singapore police have not said how many retailers or devices are implicated beyond the two cases first logged on Sept. 10, so the S$3.5 million figure may move again as more victims come forward. Ledger's Oct. 9 alert told buyers to verify devices through its own channels, but whether it offers compensation or recalls specific retail batches remains the open question that will determine how far the damage, and the liability, actually extends.

Market reaction i

Total crypto marketall crypto assets combined no single asset in the event: read against the whole market
first headline
-0.7% 2 h before
+0.1% 4 h after
$2.7Tmarket cap at publication
12data points

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Oct 29 03:16
Cointelegraph scoop
Breaks the event: $2.7M
+23 min
Oct 29 03:39
The Defiant context
Its angle: reporting, starting, defiant
+3 h 2 m
Oct 29 06:18
+6 h 9 m
Oct 29 09:25
CR Cryptopolitan context
Its angle: impersonating, cryptobilis, wednesday; with quotes
+9 h 10 m
Oct 29 12:26
Crypto Economy echo
No new facts: credentials, authorities, identified; with quotes
+18 h 23 m
Oct 29 21:40
Unchained echo
No new facts: newsletter, unchained, converted; with quotes
+18 h 51 m
Oct 29 22:07
CP CryptoPotato echo
No new facts: manufacturer, precautions, information; with quotes
+19 h 15 m
Oct 29 22:31
Cointelegraph context
Its angle: lawmakers, ledgers, express

Thefts of a similar size

WhenWhat happenedFigure
2 months ago Nostra · Oracle manipulation incident $3.5M
6 months ago Sweat Foundation · Withdrawal Logic Flaw incident $3.5M
7 months ago Volo Vaults · Private key leakage incident $3.5M
2.4 years ago Sportsbet incident $3.5M
4.2 years ago Dragoma · Admin Drain incident $3.5M

4280 incidents stored · 590 were as large as this one or larger ($3.5M)