A hardware wallet bought from an ordinary shop in Singapore turned out to be rigged before its owner ever used it — and police say cases like this have already cost users about $2.7 million. That is the part that should worry anyone who keeps coins offline: the box looked real, the device looked real, and the trap was already inside.
Key points:
- Singapore police got at least two reports since September 10, and together those users lost about S$3.5 million, which works out near $2.7 million.
- The first checks found extra hardware inside shop-bought Ledger wallets, built to grab the owner's recovery phrase or private keys.
- Ledger has asked shops across Southeast Asia to pause sales while it looks into the cases, and police say their own checks are still going on.
On Wednesday, the Singapore Police Force put out an advisory on the cases. Since September 10, at least two cases have been reported, and the total loss comes to about S$3.5 million. The first checks found that Ledger wallets bought from some shops in Singapore held malicious hardware parts. Those parts could catch the owner's recovery phrase or private keys when the device was set up. Once someone else has that phrase, they can copy the wallet somewhere else and move the coins out without the owner knowing.
This did not start in Singapore. The wider incident came out in public on October 9, after reports of losses tied to devices sold through CryptoBilis, an approved Ledger seller in Indonesia, Malaysia, and the Philippines. Days later, former Mt. Gox chief Mark Karpeles said a Ledger Flex he bought at Singapore's airport held a spy implant. On October 13, Ledger asked sellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to pause sales while it looked into the matter. Analysts put the wider losses at more than $86 million, though Ledger has not confirmed how many people were hit or the full amount lost.
Read also: Google Crypto Custody Vault for Banks — Can It Stop Key Thefts?
My own read is blunt: A hardware wallet is only as safe as the shop shelf it sat on. Buy direct from the maker when you can, and treat any shop-bought device with doubt until you have checked it out.
How do you check a wallet you already own?
Police say do not type your recovery phrase into a device you doubt, and do not keep using it for new transfers. If you think your phrase may have leaked, move what is left to a new, trusted wallet with a fresh phrase made on a clean device. Swapping the box alone does not fix it, since the thief may still hold the old phrase. Keep the phrase offline, in a safe place, and never share it with anyone. Follow the official advisories from your wallet maker for the latest steps.
Until Ledger and the police say what went wrong in the shops, anyone holding coins on a device bought from a store in the region should act as if the phrase could already be out there. That is the safe way to treat it, and it costs nothing to move coins to a fresh wallet you trust.
Read also: FEC System Hack Freezes Crypto PAC Filings Six Days Before Midterms
— BitByLine News Desk
One last thing, and it counts: This is a news story to read and learn from, nothing more. It is not financial advice, and BitByLine never tells you to buy or sell crypto. That call is always yours alone, and the risk that comes with it is yours too. Look into things yourself before you act on any of it.
Read our full Disclaimer.
Sources: Cointelegraph, Singapore Police Force, The Straits Times