Singapore Police Probe Tampered Ledger Wallets After $2.7M in Losses

By Nathan Brooks

Singapore Police Force investigators are examining at least two reported cases of tampered Ledger hardware wallets that caused combined losses of about S$3.5 million ($2.7 million), according to an advisory published Wednesday.

The reports date from as early as Sept. 10, nearly a month before the wider incident became public on Oct. 9. That timing gives the Singapore disclosure two specific functions: it establishes local losses and an earlier reporting date, rather than only widening the list of overseas retail channels involved.

Preliminary findings place the compromise in the hardware itself. The Singapore Police Force said its “preliminary investigations” found “malicious hardware components” in Ledger wallets purchased from some retail stores in Singapore.

The advisory does not specify the components, identify a device count, or establish that every Ledger model carries the same risk. Its US dollar conversion puts the known losses above US$2 million, although the case count covers only at least two reports.

Oct. 9 reporting focused on devices sold through CryptoBilis, an authorized Ledger reseller in Indonesia, Malaysia and the Philippines. CryptoBilis therefore sits inside the incident as an identified regional resale channel, not an unrelated retailer mentioned in passing.

Days after the Oct. 9 reports, Mark Karpelès, the former Mt. Gox CEO, said: “a Ledger Flex purchased at Singapore’s airport contained a spy implant.” Karpelès also said Ledger’s early implant warnings deserved more action.

His account identifies an airport purchase point. The advisory does not present it as a police finding, leaving the route by which the component entered the device and the number of similar devices unresolved.

Separately, another Ledger user claimed that a tampered unit came from Challenger, a local IT retailer. The user said Ledger later sent him a new device. Together, the accounts identify retail and airport purchase points for units that buyers said had been altered.

Oct. 13 brought a broader operational response. Ledger said it had asked retailers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend Ledger device sales while investigations continue.

The request spans seven markets and includes all three countries where CryptoBilis sold devices linked to the Oct. 9 reports. Within Singapore, police said they remain in contact with Ledger. Ledger is reviewing the affected cases, and the police investigation remains open.

What does this change for hardware-wallet buyers?

The practical change is the need to verify the purchase channel, not simply the brand printed on the device. Banks, exchanges and corporate treasuries that source hardware wallets through retailers now need to identify which sellers and units fall within the seven-market suspension.

Ledger’s response confirms that its retail distribution footprint extends across those jurisdictions, while the Singapore cases show that tampering concerns can surface through different sales points. Neither fact supports a conclusion that every Ledger device or the entire installed base carries the same risk.

The Wednesday advisory does not provide a technical explanation, a complete count of altered units or a list of cleared retailers. For procurement teams, the information gap is operational: until Ledger or the police publish clearer findings, they lack a factual basis for certifying units bought through the channels under review.

Any broader assessment would require evidence beyond the two local reports. The next milestone is a police or Ledger finding that defines the scope of the tampering; with no resolution date announced, the sales suspension and open provenance questions will remain in place for affected distributors and buyers.