Some Ledger hardware wallets sold in Singapore shops had malicious hardware components inside them, according to early findings from the Singapore Police Force. In an advisory issued on Oct. 28, police counted at least two cases reported from Sept. 10 onward, with about S$3.5 million (about $2.7 million) lost in total.
The advisory gives the figure without a currency code. Unchained reads it as Singapore dollars because the release comes from Singapore police, and converted it at the European Central Bank’s Oct. 28 reference rates, which work out to about S$1.28 per U.S. dollar.
The window police used opens on Sept. 10, 29 days before Oct. 9, when Ledger disclosed wallet drains tied to devices sold through a Southeast Asian reseller. The advisory does not say whether the Singapore cases are connected to those drains.
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
What the Police Said
According to police, the components “could capture users’ recovery phrases or private keys,” which would let outsiders get into the wallets and move funds without the owners knowing. “The SPF is in contact with Ledger, which is reviewing the affected cases,” the advisory said, adding that the investigation continues.
The advisory does not name the stores, the wallet models involved or when the devices were bought, and it does not identify any suspects.
Police urged anyone with a device they suspect was tampered with to stop entering its recovery phrase or sending transactions from it, and to reach the wallet maker through official support channels. Anyone who suspects their recovery phrase or keys were compromised should consider moving what is left to a new wallet set up with a fresh recovery phrase on a clean device, police said. They also told people never to share seed phrases, including with anyone claiming to speak for a wallet company, an exchange or law enforcement.
Ledger’s Earlier Statements
In an Oct. 13 update, Ledger said its researchers found an added part in a device bought from CryptoBilis, a Southeast Asian reseller, that decoded the recovery phrase as it appeared during setup and transmitted it over LTE, and that day it asked sellers in Singapore and six other Asian markets to pause sales. In an Oct. 15 blog post, 13 days before the police advisory, the company called the episode “a localized distribution attack” rather than a systemic supply chain one.
Rival Trezor said on Oct. 13 that it would cut the number of resellers allowed to sell its devices, citing recent supply-chain incidents. Zero Knowledge Group founder Austin Campbell has pointed to the drains to argue that self-custody users should favor simpler setups.
Police asked anyone with information to call the Police Hotline at 1800-255-0000.
Related Listen: Why a $100M Ledger Reseller Attack Has Crypto Rethinking Self-Custody
The post Singapore Police Link S$3.5 Million in Losses to Ledger Wallets Bought From Local Stores appeared first on Unchained.
Powered by WPeMatico
