Singapore’s police have issued the clearest official confirmation yet that tampered cold-storage devices are reaching ordinary buyers through legitimate-looking retail channels, not only unverified online sellers. On 28 October 2026 the Singapore Police Force warned that Ledger hardware wallets sold at “some retail stores in Singapore” had been found to contain malicious hardware components. Since 10 September, at least two cases have been reported, with combined losses of about S$3.5 million.
The mechanics matter because they change the risk model. A hardware wallet’s security rests on a secure element, a dedicated chip that generates and stores private keys so they never touch the phone or computer the wallet connects to. A physical implant attacks that model from the outside. Rather than trying to break the chip’s cryptography, an attacker solders an extra component onto the board or swaps a part inside the casing before the device reaches the buyer. That added hardware can record the recovery phrase the moment the owner types it during setup, or the device can arrive pre-seeded with a phrase the attacker already controls.
The channel also matters. Ledger’s earlier October findings in the region centred on a single online reseller, which the company could ask to halt sales and shipments. Physical retail is harder to fence off, because a tampered unit can sit on a shelf next to a genuine one with no visible difference to the buyer. At roughly S$1.75 million per reported case, the two Singapore incidents also point to substantial holdings rather than small test balances, which is exactly the kind of exposure an attacker wants.
None of this means the secure element was broken, and none of it means Ledger’s own systems were accessed. It is a supply-chain compromise at the point of sale, which is why the police guidance is procedural rather than a recall. Buyers are told to follow their wallet provider’s advisories, to avoid entering a recovery phrase or transacting on a device they suspect has been tampered with, and to move any assets to a freshly generated wallet on an uncompromised device if they believe a phrase or key was exposed. The comparison against a hot wallet stays lopsided in the hardware wallet’s favour, because a remote attack surface is removed even when a device still needs to be checked for tampering.
The advisory also repeats the standing rule that no legitimate provider, exchange, or law-enforcement agency will ever ask for a private key or recovery phrase, and it directs residents to the ScamShield helpline at 1799 and the police hotline for reporting. The practical checklist is short: buy only from ledger.com or an authorised channel, confirm the packaging seal is intact, and let Ledger Live run its genuine-device check during first setup. A device that fails that check should never receive funds, because a failed check is the strongest early signal that a unit was opened, swapped, or tampered with before sale.
What the advisory leaves open matters as much as what it confirms. The police have not named the retailers involved, have not said whether the Singapore devices share a supplier with the tampered units Ledger identified earlier in Southeast Asia, and have not announced a recall. Ledger’s review of the affected cases is the next concrete signal. Until then, the prudent path is the one the police have already laid out: verify the device, guard the phrase, and move assets off anything that shows a hint of tampering.
Source: BlockchainReporter.