Singapore authorities have disclosed additional details in an ongoing investigation into alleged tampering involving Ledger cryptocurrency hardware wallets. According to the Singapore Police Force, at least two cases involving modified Ledger devices have been reported since Sept. 10, with combined losses of about 3.5 million Singapore dollars (roughly $2.7 million).

In an advisory published Wednesday, the police said preliminary investigations identified malicious hardware components in Ledger wallets purchased from some retail locations in Singapore. The update also places local reporting several weeks before the broader incident became widely public earlier this month.

Key takeaways

Singapore police report at least two tampered Ledger wallet cases since Sept. 10, totaling about S$3.5 million in losses.
The police advisory says preliminary findings point to malicious hardware components in certain Ledger devices sold through some local retail stores.
Local warnings preceded the wider public disclosure that followed reports from other regions.
Ledger is reviewing affected cases and had earlier urged retailers in multiple countries to pause sales while investigations continued.

Singapore adds a local timeline to a widening incident

The Singapore Police Force’s advisory states that the two reported cases date back to Sept. 10, indicating the alleged tampering may have been present—or at least detected—before international attention picked up.

That matters for investors and users because hardware wallet supply-chain risks are often time-sensitive: the earlier the issue is identified, the sooner consumers can reduce exposure, retailers can halt sales, and investigations can trace affected batches. Singapore’s update suggests that the early signals were not limited to the later, more globally circulated reports.

Police say tampered components were found in some retail purchases

In its advisory, the Singapore Police Force said preliminary investigations found malicious hardware components inside Ledger wallets purchased from some retail stores in Singapore. Police also said they are in contact with Ledger, which is reviewing the affected cases, while their own investigations remain ongoing.

The practical implication for users is straightforward but serious: even devices that appear brand-new can be compromised if the hardware itself has been altered. For anyone who purchased a Ledger device through a retailer, this raises the importance of understanding where and how the device was obtained and whether updates or guidance from the manufacturer or authorities apply to specific batches.

Public reporting began earlier outside Singapore

Singapore’s disclosure follows a wave of public discussion that first surfaced on Oct. 9, according to earlier coverage by Cointelegraph. Those reports were tied to losses involving Ledger devices sold through CryptoBilis, an authorized Ledger reseller in Indonesia, Malaysia, and the Philippines.

Further allegations circulated shortly after. Days later, former Mt. Gox CEO Mark Karpelès said on X that a Ledger Flex purchased at Singapore’s airport contained a spy implant. Another user claimed on X that a tampered Ledger device was bought from Singapore’s IT retailer Challenger, adding that the user was later sent a new device from Ledger.

While those social posts reflect user experiences rather than official findings, they align with the broader theme that some devices may have been altered before reaching end customers—an issue that can be difficult for consumers to detect without investigation.

Ledger’s regional response and the risk to the supply chain

Ledger later said it had asked retailers across multiple regions—including Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong—to suspend sales of Ledger devices while investigations are ongoing, as reported by Cointelegraph on Oct. 13.

Singapore’s police advisory effectively reinforces the need for that kind of precaution. If malicious components were present in devices acquired through retail channels, pausing sales can limit further exposure and help investigators narrow down affected inventory. However, the reports also highlight a lingering uncertainty: which specific devices or batches were altered, how widely the compromised hardware may have been distributed, and what verification steps (if any) customers can take after purchase.

For traders and long-term holders, the bigger lesson is that custody risk is not only about software vulnerabilities or market behavior; it can also involve physical supply-chain tampering. The incident serves as a reminder that hardware wallets—often seen as the most secure option for self-custody—still depend on trustworthy distribution and device integrity.

Readers should watch for updates on the investigation’s findings, especially any information that helps identify affected batches and outlines what users should do if they believe their device may be compromised.