Two cases involving tampered Ledger hardware wallets have cost victims in Singapore about S$3.5 million, police said on Oct 28. The cases were reported since Sept 10.
Preliminary investigations found malicious components in devices bought at some Singapore shops. These could capture recovery phrases or private keys, enabling unauthorised transfers. Police are investigating, while Ledger is reviewing the cases.
How a recovery phrase puts funds at risk
A recovery phrase lets someone restore access to a cryptocurrency wallet. If an attacker obtains it, they can recreate the wallet elsewhere and move its assets.
Ledger said in an Oct 15 update that criminals had opened genuine devices, added components to capture recovery phrases during setup, then returned the devices to distribution through resellers in South-east Asia.
The company said its chip, operating system and servers had not been compromised. It described the incident as an attack on the distribution channel after the devices left its control.
A successful authenticity check may offer little reassurance against this particular attack. Researchers at Tibane Labs say the extra hardware can leave Ledger’s secure chip intact, allowing a modified device to pass the check.
What owners should do
For anyone who suspects their recovery phrase has been exposed, replacing the physical device alone does not remove the risk: the attacker may still hold the credentials.
Tibane Labs advises moving assets to a trusted wallet with a newly generated recovery phrase. Owners should avoid entering recovery words into a suspect device.
Keep the phrase offline and private. In separate cryptocurrency-security guidance issued on July 1, Singapore police advised users to store it physically in a secure place and never share it. They also warned against entering it on websites, applications or devices that users do not fully trust.
Be wary of anyone offering help by phone. Ledger says it does not provide telephone support and will never ask for a customer’s recovery phrase, including through its support team. Use its official support website to seek assistance.
