A hardware wallet is only as safe as the box it came in.
Singapore police said on Oct 28 that at least two cases since Sept 10 involved Ledger devices bought from some local retail stores that carried malicious hardware components. Those parts could capture recovery phrases or private keys. Total losses: about S$3.5M (roughly US$2.7M). Ledger is reviewing the cases, and it had already suspended sales across Southeast Asia and Hong Kong earlier this month. Some on-chain analysts put wider losses above US$86M, but Ledger says it can't confirm that number.
My take: this is a supply-chain story. The chip design wasn't broken. Someone swapped in parts before the device reached the buyer.
What I'd actually do:
- Buy only from the official store, never resellers or discounted marketplace stock
- Any device that comes with a pre-printed seed card is compromised
- Treat any device bought from a reseller in the region as compromised. Generating a new phrase on it doesn't help, because tampered hardware can capture that too
- Move funds to a new device bought from the official store, and generate a fresh phrase on that one
- Nobody legit (support, exchange, police) will ever ask for your seed
#CryptoSecurity #HardwareWallet #Ledger #SelfCustody
Not financial advice.
Singapore police said on Oct 28 that at least two cases since Sept 10 involved Ledger devices bought from some local retail stores that carried malicious hardware components. Those parts could capture recovery phrases or private keys. Total losses: about S$3.5M (roughly US$2.7M). Ledger is reviewing the cases, and it had already suspended sales across Southeast Asia and Hong Kong earlier this month. Some on-chain analysts put wider losses above US$86M, but Ledger says it can't confirm that number.
My take: this is a supply-chain story. The chip design wasn't broken. Someone swapped in parts before the device reached the buyer.
What I'd actually do:
- Buy only from the official store, never resellers or discounted marketplace stock
- Any device that comes with a pre-printed seed card is compromised
- Treat any device bought from a reseller in the region as compromised. Generating a new phrase on it doesn't help, because tampered hardware can capture that too
- Move funds to a new device bought from the official store, and generate a fresh phrase on that one
- Nobody legit (support, exchange, police) will ever ask for your seed
#CryptoSecurity #HardwareWallet #Ledger #SelfCustody
Not financial advice.
