The biggest risk to a cold wallet isn’t hackers—it’s buying one at a shop that’s been tampered with.
On October 28, the Singapore Police issued an official notice👇
1️⃣ Since September 10, at least 2 cases have been reported, with combined losses of approximately S$3.5 million
2️⃣ Preliminary investigations found that some Ledger hardware wallets purchased from retail stores in Singapore contained malicious hardware components capable of intercepting recovery phrases/private keys and secretly transferring assets
3️⃣ The police have contacted Ledger. Ledger is reviewing the cases, and the investigation is ongoing
A bit of background: In mid-October, Ledger had already asked distributors in Southeast Asia (including Singapore and Hong Kong) to suspend sales. This is the first time an official loss amount has been disclosed, and the matter has gone from a “researcher’s report” to a “police investigation.”
My takeaways:
- Buy hardware wallets only from the official website or authorized channels. Pass on second-hand devices that are a few hundred dollars cheaper, personal-shopping services, or anything from an unknown source
- Check the packaging and verify the firmware as soon as you get it. Any “pre-filled recovery phrase card” = 100% a red flag
- If you suspect a device has been tampered with, don’t enter your recovery phrase or sign transactions on it again. Generate a new recovery phrase on a clean device and transfer the remaining $BTC $ETH and other assets over
- Anyone claiming to be official support, an exchange, or the police and asking for your recovery phrase is a scammer
The security assumption behind a cold wallet is that the “supply chain is trustworthy.” Once that assumption is broken, even the most expensive device is just a pretty USB drive.
Sources: Official notice from the Singapore Police Force (2026-10-28), The Straits Times, AsiaOne
This is not investment advice. For security matters, rely on official channels.
On October 28, the Singapore Police issued an official notice👇
1️⃣ Since September 10, at least 2 cases have been reported, with combined losses of approximately S$3.5 million
2️⃣ Preliminary investigations found that some Ledger hardware wallets purchased from retail stores in Singapore contained malicious hardware components capable of intercepting recovery phrases/private keys and secretly transferring assets
3️⃣ The police have contacted Ledger. Ledger is reviewing the cases, and the investigation is ongoing
A bit of background: In mid-October, Ledger had already asked distributors in Southeast Asia (including Singapore and Hong Kong) to suspend sales. This is the first time an official loss amount has been disclosed, and the matter has gone from a “researcher’s report” to a “police investigation.”
My takeaways:
- Buy hardware wallets only from the official website or authorized channels. Pass on second-hand devices that are a few hundred dollars cheaper, personal-shopping services, or anything from an unknown source
- Check the packaging and verify the firmware as soon as you get it. Any “pre-filled recovery phrase card” = 100% a red flag
- If you suspect a device has been tampered with, don’t enter your recovery phrase or sign transactions on it again. Generate a new recovery phrase on a clean device and transfer the remaining $BTC $ETH and other assets over
- Anyone claiming to be official support, an exchange, or the police and asking for your recovery phrase is a scammer
The security assumption behind a cold wallet is that the “supply chain is trustworthy.” Once that assumption is broken, even the most expensive device is just a pretty USB drive.
Sources: Official notice from the Singapore Police Force (2026-10-28), The Straits Times, AsiaOne
This is not investment advice. For security matters, rely on official channels.