Ledger wallets got a spy twist in Asia — and Singapore users lost $2.7M 🧨

Singapore police say at least two cases involving tampered Ledger hardware wallets have been reported since Sept. 10, with combined losses of about 3.5 million Singapore dollars ($2.7 million). The reports predate the wider incident becoming public by almost a month.

In an advisory published Wednesday, the Singapore Police Force said preliminary investigations found malicious hardware components in Ledger wallets purchased from some retail stores in Singapore. The disclosure came after the incident surfaced publicly on Oct. 9, following reports of losses involving devices sold through CryptoBilis, an authorized Ledger reseller in Indonesia, Malaysia and the Philippines.

Days later, former Mt. Gox CEO Mark Karpelès said that a Ledger Flex purchased at Singapore’s airport contained a spy implant. Another Ledger user claimed to have a tampered device bought from local IT retailer Challenger. The user said he was later sent a new device from Ledger.

On Oct. 13, Ledger said it has asked retailers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend sales of Ledger devices as investigations are ongoing. Singapore police said it is in contact with Ledger, which is reviewing the affected cases, while police investigations are ongoing.