On October 28, the Singapore Police Force issued an official advisory. This matters to anyone who uses a hardware wallet.
Since September 10, there have been at least two cases involving losses of around SGD 3.5 million (approximately USD 2.7 million). Preliminary investigations found that Ledger hardware wallets purchased from some physical retail stores in Singapore had been fitted with malicious hardware that could directly read your recovery phrase and private keys.
The method is more brazen than you might imagine: the genuine devices were opened and fitted with an extra chip and an eSIM. The 24 words displayed on the screen during setup could be copied verbatim and sent over a mobile network. Opening the casing reveals extra antenna wires. For reference, modified devices were reportedly sold for about half the original price.
Since October 13, Ledger has asked retailers to suspend sales in seven markets across Southeast Asia and Hong Kong. The company says this was a targeted distribution attack involving one reseller, not a systematic supply-chain breach. On-chain analysts estimate the total losses at USD 86 million to USD 93 million, and Tether froze around 10 million USDT.
The most important thing to remember: Ledger’s Genuine Check only verifies that the chip is genuine. If the original chip hasn’t been replaced, it won’t detect physical modifications. So the real risk of self-custody often isn’t the device itself, but who you buy it from.
Since September 10, there have been at least two cases involving losses of around SGD 3.5 million (approximately USD 2.7 million). Preliminary investigations found that Ledger hardware wallets purchased from some physical retail stores in Singapore had been fitted with malicious hardware that could directly read your recovery phrase and private keys.
The method is more brazen than you might imagine: the genuine devices were opened and fitted with an extra chip and an eSIM. The 24 words displayed on the screen during setup could be copied verbatim and sent over a mobile network. Opening the casing reveals extra antenna wires. For reference, modified devices were reportedly sold for about half the original price.
Since October 13, Ledger has asked retailers to suspend sales in seven markets across Southeast Asia and Hong Kong. The company says this was a targeted distribution attack involving one reseller, not a systematic supply-chain breach. On-chain analysts estimate the total losses at USD 86 million to USD 93 million, and Tether froze around 10 million USDT.
The most important thing to remember: Ledger’s Genuine Check only verifies that the chip is genuine. If the original chip hasn’t been replaced, it won’t detect physical modifications. So the real risk of self-custody often isn’t the device itself, but who you buy it from.
