The Singapore police stated that users who purchased tampered Ledger hardware wallets from local retailers have lost approximately 3.5 million Singapore dollars in cryptocurrency. The police are conducting investigations into these devices that contain malicious components.

According to a notice issued by the Singapore Police Force on October 28th, since September 10th, there have been at least two cases involving damaged Ledger devices that have been reported. Preliminary investigations have found that some wallets sold through retail stores were physically modified for the purpose of stealing sensitive information.

Investigators found that the affected devices contained unauthorized hardware components that were capable of capturing users' recovery phrases or private keys, which could subsequently be used to access their cryptocurrency holdings and transfer funds without permission.

The police have contacted Ledger, a hardware wallet manufacturer headquartered in Paris. As the investigation continues, Ledger is reviewing the relevant case.

Ledger Wallet found to contain malicious components

The losses reported this time occurred after Ledger previously launched an investigation into the damaged devices that were distributed through the Southeast Asian distributor CryptoBilis.

On October 13th, Ledger confirmed that after a user reported the theft of their cryptocurrency earlier in the month, the company discovered a hidden hardware implant on one of the devices.

The company's Donjon security team discovered that this unauthorized component was capable of capturing the 24-word recovery phrase displayed during the wallet setup process, and transmitted this information to the attacker via a LTE cellular connection.

Restoring the phrase allows users to regain access to their cryptocurrency wallets. Anyone who obtains the complete phrase could potentially recreate that wallet on another device and transfer the assets held within it.

Ledger indicates that this malicious component operates independently of the device's Secure Element, while Secure Element is intended to protect the private key; this component also does not require any modification to the wallet's operating system.

As previously reported by crypto.news, the damaged devices reached customers through distributor distribution channels. Ledger stated that its own systems and direct sales channels were not involved in the confirmed cases.

The company confirmed that on October 10th, an unauthorized hardware implant was discovered in one of the affected wallets, and they began to investigate other reported incidents that were purchased through the same distributor.

Ledger Suspends Sales in Southeast Asia

After discovering the issue, Ledger required dealers and distributors across Southeast Asia to suspend the sale and shipment of their hardware wallets until the company completes an investigation into the affected products.

The suspension measures, announced on October 13, cover Singapore, Malaysia, Indonesia, Thailand, the Philippines, Vietnam, and Hong Kong.

Ledger initially requested that CryptoBilis cease selling its devices after receiving reports from customers that their funds were stolen after purchasing wallets through that distributor.

The company recommends that customers who purchased Ledger devices from CryptoBilis within the past 90 days not to initialize unused wallets. For users who have already set up their devices, the company suggests considering transferring their assets to a new wallet that uses a newly generated recovery phrase.

According to a report by The Strait Times, damaged devices were found in the Singapore retail market. One of these devices was sold at the Metapod location at Changi Airport, while another is said to have been purchased from the Challenger store located at VivoCity.

Blockchain analysts previously estimated that the amount stolen related to these compromised wallets exceeded 86 million US dollars, but Ledger indicates that it is not possible to confirm the total loss or the number of affected users.

The figure of S$3.5 million provided by the Singapore police only covers the cases reported locally and is independent of previous regional estimates.

Ledger Wallet investigation extends to European retailers

Concerns regarding the tampered Ledger devices are not limited to Southeast Asia.

On October 13th, German electronics retailer MediaMarktSaturn suspended the sale of its Ledger hardware wallets in its physical stores and online channels after a German customer reported finding unauthorized components inside the devices.

Ledger agreed to this suspension measure, and at the same time, its security team is inspecting the reported hardware modifications.

The manufacturer stated that there were no customer funds lost in the German incident and insisted that its infrastructure, systems, and services were not damaged.

On October 26th, another hardware wallet security incident occurred: competitor Keystone disclosed that their devices had experienced a leak of authentication keys.

Keystone indicates that hackers stole a device authentication key and exposed the information of 25,964 customers, forcing the company to destroy 18,835 hardware wallets and temporarily suspend shipments.

Unlike the Ledger incident, Keystone indicates that the customer's recovery phrase and private key have not been leaked.