Singapore authorities are examining reports of Ledger hardware wallets containing unauthorized components after cryptocurrency holders reported losses totaling about S$3.5 million, equivalent to roughly $2.7 million. The cases date back to September 10, nearly a month before similar issues drew wider attention across the region.

Police Findings and Local Cases

In an advisory issued this week, the Singapore Police Force stated that preliminary inquiries identified malicious hardware in some Ledger devices purchased from retail outlets in the city-state. These components were capable of capturing recovery phrases or private keys, enabling unauthorized access and transfers of digital assets without the owners’ knowledge.

At least two incidents have been documented so far. One device was linked to a purchase at Metapod in Changi Airport, while another was reportedly obtained from a Challenger store at VivoCity. Police confirmed they have contacted the French manufacturer Ledger, which is reviewing the affected units as the probe continues.

Timeline of Discoveries and Regional Response

The Singapore reports predate the broader public revelation of compromised devices. Issues first surfaced around October 9 in connection with wallets sold through CryptoBilis, an authorized reseller operating in Indonesia, Malaysia and the Philippines. Days later, former Mt. Gox chief executive Mark Karpelès publicly noted that a Ledger Flex acquired at Singapore’s airport contained a spy implant. A separate user described a tampered unit bought from Challenger and later received a replacement from the company.

On October 13, Ledger directed retailers across Singapore, Indonesia, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to halt sales and shipments while its security team examined the products. The company’s Donjon unit determined that an unauthorized implant could intercept the 24-word recovery phrase shown during initial setup and transmit the data via an LTE cellular connection. The component functioned independently of the device’s Secure Element and did not alter the wallet’s operating system.

Ledger has maintained that its internal systems and direct sales channels were not involved in the confirmed incidents. Customers who acquired devices through the implicated reseller in the prior 90 days were advised against initializing unused wallets, while those who had already set up devices were urged to transfer assets to new wallets with freshly generated recovery phrases.

Broader Context and Ongoing Probes

Blockchain analysts have previously placed total losses connected to compromised wallets above $86 million, though Ledger has stated it cannot verify the overall figure or the precise number of affected users. The Singapore losses represent only the locally reported cases and stand apart from those regional estimates.

Similar concerns extended beyond Southeast Asia. A German electronics chain suspended Ledger sales after a customer reported an unauthorized component, though no funds were lost in that instance. The manufacturer continues to investigate the supply-chain pathway that allowed modified devices to reach retail shelves.

Police investigations in Singapore remain active, with authorities coordinating with Ledger on the technical review of the modified wallets.