Tampered Crypto Wallets Allegedly Cost Singapore Users $2.7M, Police

Singapore’s police have confirmed that at least two cases involving tampered Ledger hardware wallets were reported locally after malicious components were allegedly found in affected devices. According to the Singapore Police Force, the incidents—reported since Sept. 10—resulted in combined losses of about 3.5 million Singapore dollars (approximately $2.7 million), offering an early window into the problem before it became widely known internationally.

In an advisory published Wednesday, the police said preliminary investigations point to Ledger wallets purchased from certain retail outlets in Singapore. Investigators are coordinating with Ledger, which is reviewing the cases, as broader inquiries continue.

Key takeaways

• Singapore police report at least two tampered Ledger wallet cases dating back to Sept. 10.
• Local losses total about 3.5 million SGD (around $2.7 million), per the Singapore Police Force.
• Police preliminary findings indicate malicious hardware components in some Ledger devices sold through certain retail channels in Singapore.
• International reporting about tampering followed later, with public attention emerging on Oct. 9.
• Singapore police say they remain in contact with Ledger while investigations are ongoing.

Singapore-linked cases come to light first in local reporting

The Singapore Police Force said it has received reports of tampered Ledger hardware wallets involving malicious components. The advisory specifies that the cases were reported since Sept. 10 and that preliminary investigations found tampering in devices purchased from some retail stores in Singapore.

While the wider story gained international traction after later public posts, the Singapore timeline suggests the issue was present—and potentially being acted on—before it became a major, cross-border headline.

How the incident escalated publicly

International attention to the Ledger tampering issue surfaced publicly on Oct. 9, according to earlier coverage from Cointelegraph. That coverage referenced losses tied to devices sold through CryptoBilis, which operates as an authorized Ledger reseller across Indonesia, Malaysia, and the Philippines.

In the days that followed, additional user accounts surfaced from other regions. Days after Oct. 9, former Mt. Gox CEO Mark Karpelès said on X that a Ledger Flex he purchased at Singapore’s airport had a spy implant. Another user claimed on X that a tampered Ledger device had been bought from Singapore’s IT retailer Challenger, adding that Ledger later sent a replacement unit.

Ledger moves to pause sales across multiple markets

On Oct. 13, Ledger said it asked retailers in a number of jurisdictions to suspend sales of Ledger devices while investigations were ongoing. The markets mentioned included Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong.

This retailer-suspension step highlights the practical challenge in hardware-wallet security incidents: unlike purely software-based exploits, tampering can involve physical alterations or malicious components that must be identified and quarantined at the point of sale. By seeking a sales pause across multiple countries, Ledger effectively widened the effort to reduce the chance that affected devices remain in circulation.

What Singapore police say is happening next

Singapore police said they are in contact with Ledger, which is reviewing the affected cases. Police investigations are ongoing, and the advisory indicates that authorities are working through the reported incidents as part of their preliminary findings.

For holders and traders, the key point is that hardware-wallet risks can unfold in stages: local reports can precede broad public awareness, and losses may occur before supply disruptions are implemented. Readers should also treat user-reported claims—such as those posted by individuals online—as leads rather than confirmations, until they are reviewed by investigators and the manufacturer.

Going forward, the most important items to watch are whether additional Singapore reports emerge after Sept. 10, how Ledger characterizes the specific tampering method and supply chain exposure in each region, and whether further retailer actions extend beyond the markets already mentioned.