Tampered Ledger wallets 2026: Singapore police link malicious components to losses of about 3.5 million
Tampered Ledger wallets: what Singapore police found
The Singapore Police Force said on 28 October 2026 that preliminary investigations found malicious components, able to capture recovery phrases, in Ledger hardware wallets bought from some local retail stores, with at least two cases and losses of about 3.5 million since 10 September. It follows Ledger's own October findings about devices sold by the reseller CryptoBilis.
Piece published Reviewed by CryptoGuardz Register Desk, editorial desk
The Singapore Police Force said on 28 October 2026 that preliminary investigations found malicious hardware components in Ledger hardware wallets bought from some retail stores in Singapore. At least two cases have been reported since 10 September, with total losses of about $3.5 million; the advisory does not give the currency. The police named Ledger, said the company is reviewing the cases, and said investigations are ongoing. The stores were not named.
What the document says
The advisory describes what investigators found inside some of the tampered devices:
These components could capture users' recovery phrases or private keys.
A hardware wallet is meant to keep the recovery phrase on the device and away from any computer. A component added inside the case defeats that promise. Bitquery reports that Ledger has said the implant copies the recovery phrase during setup. The advisory says this lets someone access the wallet and move assets without the owner knowing.
The advisory does not say how many devices were affected, which models, or whether the currency of the loss figure is Singapore or US dollars.
How this connects to CryptoBilis
The police notice does not name a reseller. Ledger's own findings earlier in October do. In a post on X on 13 October, Ledger said its security team was investigating signers sold by CryptoBilis, a reseller in Southeast Asia, that contained an unauthorized hardware implant, and that it had confirmed this on 10 October for one affected user's device.
Update from Ledger Donjon on the CryptoBilis investigation 🔽@DonjonLedger is investigating Ledger signers sold by CryptoBilis, a reseller in Southeast Asia, that contained an unauthorized hardware implant. Ledger confirmed this on October 10th for one affected user's signer.…
Outside estimates of the wider CryptoBilis losses are far larger than the Singapore figure. CoinDesk reported on 12 October that the blockchain data firm Bitquery traced about $93.2 million taken from 315 wallets across six blockchains, that the research platform YFarmX put it at $94.5 million from 521 addresses across seven blockchains, and that Tether froze $10 million in USDT linked to the theft, according to Bitquery. Bitquery's investigation page has since been updated to $102.0 million from 335 wallets. Ledger had not confirmed a total as of 12 October. Whether the Singapore cases involve CryptoBilis devices is not stated in the advisory: not verified.
What it changes for users
The police advisory lists these steps:
- Follow the hardware wallet provider's advisories.
- Stop using a device suspected of tampering, do not enter the recovery phrase or make further transactions on it, and contact the provider through official support.
- If a recovery phrase may be compromised, move remaining assets to a new, trusted wallet with a newly generated recovery phrase, using an uncompromised device.
- Never share private keys or recovery phrases, including with people claiming to be from a wallet provider, an exchange or the police.
The case also shows why the seller matters. CoinDesk reported that Ledger's own website listed CryptoBilis as an authorised reseller. Ledger's record is on its register entry, and the Ledger vs Trezor comparison covers how the two makers handle setup.
Quick answers
Were Ledger wallets hacked in Singapore?
Singapore police say preliminary investigations found malicious components that could capture recovery phrases in Ledger devices bought from some local stores. At least two cases and losses of about 3.5 million, currency not stated, were reported since 10 September 2026.
Which stores sold the tampered Ledger wallets?
The police did not name them. Ledger has said separately that the implanted devices it confirmed were sold by CryptoBilis, a Southeast Asian reseller.
How much was stolen through tampered Ledger devices?
The Singapore advisory gives about 3.5 million, without a currency. For the wider CryptoBilis case, Bitquery's investigation page shows $102.0 million from 335 wallets. Ledger had not confirmed a total as of 12 October.
Sources
- Singapore Police Force, Police advisory on tampered cryptocurrency hardware wallets, 28 October 2026, retrieved 1 November 2026
- Ledger on X, update on the CryptoBilis investigation, 13 October 2026, retrieved 1 November 2026
- CoinDesk, Ledger claims CryptoBilis cases are limited as up to $93M is traced and $10M frozen, 12 October 2026, retrieved 1 November 2026
- Bitquery, Ledger CryptoBilis investigation, retrieved 1 November 2026
About this piece
Compiled by the CryptoGuardz register team from the sources listed above. Research and drafting are AI-assisted and reviewed by a named editor before publication. Nothing here is a recommendation to gamble. If a figure or a reading is wrong, tell us and the correction is logged in public.