Singapore police said on Oct. 28 that Ledger hardware wallets bought from some local retailers contained malicious hardware implants able to capture recovery phrases or private keys, with at least two cases reported since Sept. 10 and about S$3.5 million (about $2.7 million) lost. Details are in the police advisory, summarized by WuBlockchain and DefiantNews.

Singapore police said on Oct. 28 that Ledger hardware wallets bought from some local retailers contained malicious hardware implants able to capture recovery phrases or private keys, with at least two cases reported since Sept. 10 and about S$3.5 million (about $2.7 million) lost. Details are in the police advisory, summarized by WuBlockchain and DefiantNews.

Police said they are in contact with Ledger, which is reviewing the affected cases, and that investigations are ongoing. Police advised users not to keep crypto on suspected devices, not to enter recovery phrases on them, and to contact the maker through official support.

This fits Ledger's earlier account of an organized months-long reselling scheme where genuine devices were implanted to read the setup screen and send the 24-word phrase over LTE, without altering the Secure Element or compromising Ledger infrastructure. Ledger had previously said then-confirmed drains involved CryptoBilis-sold devices, with no verified drain from devices bought elsewhere.

The wider campaign total remains unconfirmed. Earlier claimed figures of $90M+ to $100M stolen are attributed claims, not verified here.