Singapore cryptocurrency holders can lose assets even when they buy a physical wallet to keep their keys offline. The Singapore Police Force (SPF) warned on 28 October 2026 that tampered Ledger hardware wallets bought from some local retail stores contained malicious components capable of capturing recovery phrases or private keys. At least two cases had been reported since 10 September, with losses of about S$3.5 million.
The danger is inside the device, not necessarily in a suspicious message. Someone who obtains the secret protecting a wallet can access it and transfer assets without the owner’s knowledge or consent. SPF described its findings as preliminary and said it was in contact with Ledger, which was reviewing the affected cases. Its advisory did not identify the retailers or explain where the devices had been altered.
This is not the usual fake investment app or phishing link. A buyer may have paid for a physical security device at a shop and still received something unsafe. If you recently bought or set up a hardware wallet, do not panic and do not follow unsolicited “verification” or “recovery” instructions. Check the provider’s official advisory through a web address you type yourself. If you suspect tampering, stop using the device and do not enter the recovery phrase again.
How This Hardware Wallet Attack Works in Singapore
A cryptocurrency wallet does not literally store coins. It manages the private keys that authorise transactions on a blockchain. A recovery phrase, sometimes called a seed phrase, can recreate those keys. Anyone who obtains it may be able to take control of the wallet, even without the original device.
Hardware wallets reduce exposure by keeping key operations on a separate physical device. That protection depends on the device, its software and its setup process being trustworthy. SPF’s preliminary findings point to a supply-chain problem: malicious components were allegedly present inside devices sold through some Singapore retail stores. This makes the physical supply chain part of the security question. The advisory does not establish at which stage the devices were altered.
The advisory says the components could capture recovery phrases or private keys; it does not give a technical account of exactly when or how that capture occurred. Avoid filling that gap with assumptions about every model or setup procedure. What matters for the owner is the consequence: keeping the device in your possession does not protect assets if someone else has obtained the keys needed to control them.
This mechanism is different from three more familiar threats. In a phishing attack, the user types a recovery phrase into a fake website. In a support impersonation scam, a caller or message asks the user to reveal it. In a malicious approval scam, the user signs a transaction or token permission that can let another address move certain assets. With physical tampering, the device itself may collect the secret without an obvious fake page or caller.
That difference matters. Advice such as “do not click suspicious links” remains useful, but it is not enough. Buyers also need to consider where a device came from, whether the provider has issued an incident notice and whether anything about the device or setup departs from official instructions.
The Immediate Warning for Recent Buyers
SPF told users to follow official advisories from their hardware wallet providers. Use a separate, clean device to visit the provider’s official website and check whether there is guidance relevant to your purchase. Do not assume that a model, seller or purchase period is affected unless a reliable advisory identifies it. Do not use a link sent in a direct message, email, advertisement or forum reply. An incident like this creates an opening for follow-up scammers who pose as support staff.
Stop if a wallet arrived with a recovery phrase already printed, written or supplied to you. For a new wallet, follow the provider’s official process to generate your own recovery phrase; do not use one chosen by a seller or support agent. This is a separate warning sign, not a detail SPF reported about the Singapore cases. Likewise, nobody helping with a return, inspection or replacement needs your recovery phrase or private key.
Treat unexplained transactions as evidence of compromise. Also pay attention to a wallet that behaves differently from the provider’s official setup instructions, prompts you to reveal a recovery phrase in an unusual place, or comes with inserts directing you to an unfamiliar website. These signs do not prove that a malicious component is present, but they are enough to pause and contact official support.
Do not dismantle a suspected wallet unless the provider or Police gives you specific instructions. Opening it may damage evidence or make professional inspection harder. Keep the device, packaging, receipt, seller details and correspondence. Photograph the condition of the item without reconnecting it or entering sensitive information.
Real-World Impact and What Is Confirmed
The confirmed Singapore figures are limited but serious. SPF reported at least two cases since 10 September 2026 and total losses of about S$3.5 million. The Police named Ledger hardware wallets and said the affected devices had been bought from some retail stores in Singapore. SPF did not identify the stores in its advisory, and investigations remain ongoing.
The Straits Times’ report, published on 28 October and updated on 29 October, corroborated the Police account. It also reported that Ledger had suspended regional sales, referring to earlier reporting on 14 October. That is context from the newspaper, not an additional finding in the SPF release. This guide uses the approximately S$3.5 million figure attributed to SPF and does not treat wider, unconfirmed estimates as Singapore losses.
The lesson is not that every hardware wallet is unsafe. It is that “offline” does not mean “risk-free”. Physical devices have a chain of custody: manufacturing, distribution, storage, retail sale and delivery. These are places to examine when assessing custody risk, not a finding that every stage failed in this incident.
For SMEs, family offices and teams that hold digital assets, the issue is also operational. One employee should not be able to buy, initialise and fund a security device without independent checks. A device may be small, but the decision to trust it can expose the organisation’s entire wallet balance.
How to Protect Yourself
Check the provider’s official incident guidance. Type the official domain into your browser or use a trusted bookmark. Look for notices that match your model, region and purchase channel. Do not rely on screenshots or forwarded messages because they may be outdated or altered.
Pause use of a suspected device. SPF advises users not to enter recovery phrases or conduct further transactions on a device suspected of tampering. Disconnect it and seek instructions through the provider’s official support channel.
Never reveal the recovery phrase. SPF specifically warns against sharing private keys, recovery phrases or seed phrases with anyone, including people claiming to represent a hardware wallet provider, cryptocurrency exchange or law-enforcement agency. This rule still applies during an incident investigation. Support can verify a purchase or arrange an inspection without asking for the secret that controls your assets.
Buy through channels named by the provider. Before purchasing, check the provider’s current list of official stores or authorised sellers. Keep the receipt, serial details and packaging. An authorised sales channel reduces risk but should not replace current incident checks, particularly while a provider is reviewing a regional supply-chain issue.
Compare setup steps with official documentation. Use instructions from the provider’s own website or app. Do not install software from a QR code, search advertisement or third-party download page without checking the domain. Stop if the device asks you to use a recovery phrase supplied in the box or to share one with “support”.
Separate holdings and approvals. Consider whether concentrating all holdings under one recovery phrase creates more risk than your organisation can accept. For business holdings, require at least two people to approve new custody devices, wallet migrations and large transfers. Where appropriate, consider a properly designed multi-signature arrangement so that one compromised key cannot move everything. Get specialist advice before changing custody architecture.
Test procedures before moving a large balance. A small test transaction can confirm that addresses and approvals work as expected, although it cannot prove that hardware is free of tampering. Record the intended destination independently and compare it on the hardware device itself. Do not let a caller or chat contact guide the process live.
Protect the recovery phrase offline. Do not photograph it, store it in cloud notes, send it through messaging apps or type it into a website. A recovery phrase should not be entered into an ordinary computer or phone simply because someone says the wallet needs “verification”.
What to Do If You May Be Affected
First, stop using the suspected device. Do not enter the recovery phrase, approve another transaction or reconnect it to “check whether it is safe”. Use a separate, clean device to contact the wallet provider through its official support channel.
If you believe the recovery phrase or private key has been exposed, SPF advises considering a transfer of remaining assets to a new, trusted wallet with a newly generated recovery phrase, using an uncompromised device. This step is time-sensitive but technically unforgiving. Verify the destination carefully and do not accept live help from an unsolicited contact. If you are not confident, obtain assistance through the provider’s verified support route or a trusted custody professional who will not ask to see the recovery phrase.
Contact any cryptocurrency exchange or regulated custodian involved as soon as possible. Give them transaction hashes, wallet addresses, timestamps and the Police report number when available. They may be able to flag an account or preserve records, although recovery is not guaranteed.
Make a Police report and preserve evidence. Keep the suspected wallet, receipt, packaging, seller name, order confirmation, serial information, support correspondence and blockchain transaction records. SPF asks anyone with information to call the Police Hotline at 1800-255-0000 or submit information through the Police i-Witness service. Call 999 only when urgent Police assistance is required.
If you are unsure whether a message or support approach is genuine, call the 24/7 ScamShield Helpline at 1799 or use the ScamShield app. Do not pay a “recovery fee”, “tax”, “gas deposit” or “verification charge” to release stolen cryptocurrency. SPF explicitly warns about unsolicited wallet-verification and recovery assistance. Treat any such approach as a separate risk, even if the person already knows you bought an affected device.
Common Mistakes to Avoid
One mistake is assuming that a sealed-looking box proves authenticity. A visual check of the box cannot establish what is inside the device. Check the current provider advisory and seller channel instead of relying on appearance alone. Do not treat an intact seal as a technical inspection.
Another is continuing to use a suspected wallet because no unauthorised transfer has appeared. The absence of a visible loss does not prove that the phrase remains secret. Adding funds to a wallet whose keys may be exposed puts those additional assets at risk.
Do not reuse the old recovery phrase on a replacement device. If the phrase may be compromised, putting it into new hardware recreates the same exposed wallet. A replacement setup must use a newly generated recovery phrase, and remaining assets must be moved to addresses controlled by the new keys.
Avoid posting serial numbers, receipts or detailed wallet balances publicly while seeking help. Share evidence only through verified official channels. Public requests for assistance can attract impersonators who promise a fast fix.
Businesses should not let urgency remove normal controls. A rushed wallet migration can send assets to the wrong address or expose a new phrase. Use a written incident checklist, independent address verification and dual approval for material transfers.
FAQ
Are all Ledger hardware wallets in Singapore compromised?
No. SPF reported recent incidents involving tampered Ledger devices purchased from some retail stores in Singapore; it did not say that every device was affected. Check Ledger’s official support guidance for the latest scope and contact official support if your purchase may be involved. The SPF advisory alone does not provide a complete affected-device list.
Can antivirus software detect a malicious hardware component?
Do not assume it can. Antivirus software checks the computer environment and known malicious files, but the Police advisory concerns components inside a physical wallet. Follow the provider’s official inspection or replacement process rather than treating a clean computer scan as proof that the wallet is safe.
Should I type my recovery phrase into a website to verify the wallet?
No. SPF says never disclose private keys, recovery phrases or seed phrases. Do not enter the phrase into a website, form or chat sent by a supposed support agent. Use only the provider’s official support channel, and reject any process that asks for the secret controlling the wallet.
What if I bought the wallet from a physical shop and kept the receipt?
Keep the receipt and all packaging, but a retail purchase alone does not rule out tampering. SPF’s advisory specifically concerns devices bought from some retail stores in Singapore. Check the provider’s latest guidance and preserve the purchase records in case support or investigators need them.
What should I do if cryptocurrency has already left my wallet?
Stop using the device, preserve the transaction hashes and wallet addresses, contact the relevant exchange or custodian, and make a Police report immediately. If assets remain and the old recovery phrase may be exposed, follow SPF’s guidance on moving them to a new trusted wallet with a newly generated phrase using an uncompromised device.
Can a wallet provider or Police officer ask for my seed phrase during an investigation?
SPF’s advisory says not to share private keys, recovery phrases or seed phrases with anyone, including people claiming to represent hardware wallet providers, exchanges or law enforcement. A request for the phrase is a red flag. End the contact and verify through an official number or website.
How can a Singapore SME reduce hardware-wallet supply-chain risk?
Use approved purchasing channels, keep procurement records, require two people to verify setup and destination addresses, and prevent one employee from controlling purchase, initialisation and transfers. Consider professional custody advice and multi-signature controls where the value and operational needs justify them.
Conclusion
The key warning is simple: a hardware wallet can reduce online exposure, but only if the device and setup process can be trusted. SPF’s 28 October advisory shows why Singapore users must treat the physical supply chain as part of wallet security.
If your device may be affected, stop using it, do not enter the recovery phrase and contact the provider through its official website. Preserve the wallet and purchase records. If assets have moved or the phrase may be exposed, contact the relevant exchange or custodian and report the matter to Police without delay. For help checking a suspicious approach, call ScamShield at 1799. Do not let anyone turn a genuine security incident into a second recovery scam.
Sources checked for this 5 November 2026 backfill: Singapore Police Force advisory, 28 October 2026; The Straits Times report, 28 October 2026.