Singapore Reports S$3.5 Million Lost in Tampered Ledger Wallet Cases

Singapore police said cryptocurrency losses of about S$3.5 million have been reported in two cases involving Ledger hardware wallets allegedly modified with malicious components. The Singapore Police Force said the cases involved devices purchased from local retailers since September 10, and investigations are continuing. In an October 28 advisory, police said preliminary investigations found components in the affected wallets capable of capturing users’ recovery phrases or private keys. Those credentials could enable someone to access cryptocurrency holdings and transfer funds without authorization. The findings remain preliminary, and police have contacted Ledger, which is reviewing the cases and affected devices. Ledger’s security team previously reported finding an unauthorized component in an affected wallet. In the company’s October 13 account, its Donjon team said the component could capture a 24-word recovery phrase during setup and transmit it through an LTE connection. Ledger said the implant operated separately from the device’s Secure Element, which is designed to protect private keys. The Singapore estimate concerns the two cases reported locally. Blockchain...