No public confirmation establishes that the Ledger Flex bought at Challenger VivoCity contained spyware. The buyer first asked others to confirm the suspicion, then called the device compromised and said it weighed 57.5 grams, but those are the buyer’s claims, not a published examination result (original post, later post). BenYorke called it a confirmed Singapore case, without presenting verification in that post (BenYorke). Ledger’s October 13 update said it had not verified a drain linked to a signer bought elsewhere and was reviewing reports; it did not confirm this Challenger device (Ledger). The sources do not name a technical finding for this specific device.