The Singapore Police Force (SPF) has issued a public advisory highlighting recent incidents involving compromised Ledger cryptocurrency hardware wallets. Since 10 September 2026, authorities have received reports of at least two cases in which individuals suffered combined losses of approximately S$3.5 million after purchasing the devices from certain retail outlets in Singapore.
Hardware wallets are physical devices designed to store private keys offline, offering greater protection against online hacking compared with software wallets or exchange accounts.
However, preliminary police investigations indicate that some Ledger units sold through local retailers contained malicious hardware components.
These unauthorized elements were capable of capturing users’ recovery phrases or private keys. Once obtained, such information enabled unauthorized parties to access the victims’ cryptocurrency holdings and transfer assets without the owners’ knowledge or consent.
The SPF stated that it remains in contact with Ledger, the Paris-based manufacturer of the devices, which is reviewing the affected cases.
Police investigations are continuing, and officials have not yet publicly identified the specific retail stores involved or detailed the precise method by which the malicious components were introduced into the supply chain.
In the advisory dated 28 October 2026, police urged the public to exercise caution when holding or transacting in cryptocurrencies.
They recommended several practical steps.
First, users should stay informed by consulting official advisories issued by their hardware wallet providers for the latest guidance and precautionary measures. Second, individuals should avoid keeping cryptocurrencies on any device suspected of tampering.
They should refrain from entering recovery phrases or conducting further transactions on such units and instead contact the manufacturer through official support channels.
Those who believe their recovery phrases or private keys may have been exposed are advised to consider moving remaining assets to a new, trusted wallet with a freshly generated recovery phrase, using an uncompromised device.
Third, the public is strongly cautioned never to disclose private keys, recovery phrases, or seed phrases to anyone.
This includes individuals claiming to represent hardware wallet companies, cryptocurrency exchanges, or law enforcement agencies.
Unsolicited messages offering wallet verification or recovery assistance should be treated with suspicion.
Anyone with information related to these incidents is encouraged to contact the Police Hotline at 1800-255-0000 or submit details online via www.police.gov.sg/i-witness.
All information will be treated confidentially. For urgent police assistance, the public should dial 999.
Those uncertain whether a communication is a scam can call the 24/7 ScamShield Helpline at 1799 or use the ScamShield app.
Additional resources are available at www.scamshield.gov.sg.
This advisory underscores ongoing risks associated with the physical supply chain for cold storage devices, even when purchases occur through conventional retail channels.
Hardware wallets remain a widely recommended security practice for cryptocurrency holders, yet the incidents illustrate that device integrity cannot be assumed solely from packaging or point of sale.
Users are reminded that the security of offline storage ultimately depends on both the authenticity of the hardware and careful handling of recovery information after setup. As investigations proceed, the SPF continues to emphasize vigilance and adherence to manufacturer guidance while working with Ledger to address the affected cases.
