Singapore police warn of Ledger wallet tampering after at least 2 cases
An October 28, 2026 advisory puts losses at about $3.5 million and says Ledger is reviewing the affected cases while police investigate.
Loading… Բեռնվում է…
An October 28, 2026 advisory puts losses at about $3.5 million and says Ledger is reviewing the affected cases while police investigate.
Singapore police said preliminary investigations found malicious hardware components in Ledger cryptocurrency wallets bought from some retail stores in Singapore. Their October 28, 2026 advisory said at least 2 cases had been reported since September 10, 2026, with losses of about $3.5 million. The advisory does not specify the currency.
The Hacker News described an earlier investigation by hardware-wallet maker Ledger into losses among customers who bought from Southeast Asian reseller CryptoBilis. Trezor, another wallet maker, dropped CryptoBilis as an authorized reseller on October 9, 2026. Ledger has since confirmed that one affected customer’s wallet contained an unauthorized hardware implant designed to capture the recovery phrase during setup.
A recovery phrase, also called a seed phrase, is a list of words that can restore access to a wallet and its private keys. Those keys allow cryptocurrency to be accessed and sent. Singapore police said the malicious components could capture recovery phrases or private keys, allowing unauthorized people to access wallets and transfer assets without the owners' knowledge or consent.
Trezor warns that restoring the old recovery phrase on another device does not remove the risk: a tampered wallet could already have transmitted that phrase.
Trezor’s October 30 warning rests on a customer’s report, rather than a completed device examination. The customer said a Safe 5 wallet bought from CryptoBilis contained an extra circuit board that read the screen, including the recovery phrase, and transmitted it over a mobile network when plugged in. Trezor had not yet examined the wallet and says it does not know who is responsible for the reported tampering.
CISA orders federal agencies to patch by 1 November under a binding directive, while urging other operators to act. GitLab has released fixes and threat detections for customers running their own servers.
Trezor says it has the customer’s photographs and description and interviewed him by video. It considers the report credible enough to warn buyers now, saying that waiting for laboratory confirmation would leave CryptoBilis buyers exposed in the meantime.
Singapore police advise owners not to enter recovery phrases or conduct further transactions on suspected tampered devices, and to contact their wallet provider through official support channels. Anyone who suspects their phrase or private keys have been compromised should consider transferring remaining assets to a new, trusted wallet with a newly generated recovery phrase, using an uncompromised device.
Trezor’s advice covers every Trezor model bought since March 2026 from CryptoBilis or a store supplied by it. The company tells existing users to move funds to a new wallet with a new recovery phrase as soon as possible. Buyers who have not set up their devices should not do so or enter an existing recovery phrase. Trezor asks affected buyers to keep the devices and contact Trezor Support; it offers a replacement device or a voucher covering the cost of one.
Singapore police are continuing their investigation and are in contact with Ledger, which is reviewing the affected cases. Trezor is arranging for the reported Safe 5 wallet to be sent to its laboratory for examination.
2 min
The proposed terms remain on hold. The inquiry will determine whether Meta is dominant in a relevant UK market and, if so, whether the terms abuse that position.
3 min
The agreement with 35 US states and Washington, DC requires GM to limit driving-data collection, protect personal information and strengthen privacy checks and dealership oversight.
3 min