Singapore police report S$3.5 million lost through tampered Ledger wallets
Source report: 2026-10-28 · Editorial analysis published: 2026-10-29
An October 28 police advisory describes at least two cases reported since September 10 and malicious components found in retail-bought devices. Mining payouts need a trustworthy receiving wallet as well as a correct address.
A fresh police disclosure adds a local loss figure
Singapore police warned on October 28 that tampered Ledger hardware wallets had been linked to at least two reported cases since September 10, with combined losses of about 3.5 million Singapore dollars. Preliminary investigations found malicious hardware components in devices bought from some retail stores in Singapore. The police are in contact with Ledger, which is reviewing the affected cases, and the investigation is continuing.
The new event is this police advisory and its local case count, not proof that every loss happened on October 28. The notice does not name the retailers, device models or affected serial-number ranges. It also does not establish that every Ledger is compromised. Reports of a wider regional incident should not be added to this Singapore figure as though they were one independently verified total.
How a receiving wallet can become the weak link
According to the preliminary police findings, the added components could capture a recovery phrase or private keys. Those secrets can let an unauthorized person access the wallet and transfer assets. A recovery phrase is the backup that can recreate control of a wallet; it is not a delivery code or an account number that support staff need to read back. Keeping a device physically in your possession does not protect the coins if someone else has obtained that secret.
For a miner, the connection is the destination of payouts. The pool can send coins to the intended address correctly, while an attacker who knows that wallet’s keys can later move them. That is a different failure from a wrong payout address or an unpaid pool balance. A transfer reaching the right address therefore does not, on its own, demonstrate that the receiving setup remains under the miner’s exclusive control.
What the police advise if a device looks suspect
The advisory tells users not to keep cryptocurrency in a suspected tampered device and to avoid entering recovery phrases or making further transactions with it. It directs people to the wallet provider’s official support channels. If phrases or private keys may have been compromised, police say users should consider moving remaining assets to a new trusted wallet with a newly generated phrase on an uncompromised device.
The important change in that guidance is the new secret, not just a new screen or PIN. Restoring the same possibly exposed recovery phrase into a replacement device retains the same underlying control over the wallet. A clean device and a new wallet are different from a fresh-looking copy of the old wallet. Do not type the old phrase into an unsolicited “verification” page while trying to solve the original problem.
The notice does not instruct every owner to open or repair a device at home. It gives no visual test that guarantees a device is safe. Follow the provider’s current official guidance for the particular situation instead of treating a sealed box, a working display or a successful small transfer as a complete inspection of its hardware. This report does not identify an affected serial range for readers to self-clear against.
Avoid turning a security warning into a second scam
The police warn against sharing keys or recovery phrases with anyone, including people claiming to represent wallet makers, exchanges or law enforcement. Unsolicited wallet-verification or recovery offers are specifically a concern. Navigate independently to the official provider rather than trust a support link sent in response to a public complaint about lost coins.
A genuine investigation update is information, not a request to send your backup phrase to a stranger. For mining operators with more than one receiving wallet, identify which wallet and secret were used by the suspect device before making claims about the scope. The Singapore notice does not show that unrelated wallets or all devices from the same shop were affected. That distinction helps organize a response without minimizing the account that may actually be exposed.
What this changes for a mining payout routine
Keep the pool’s payment record and the receiving wallet’s security as separate checks. The first establishes what was sent and where; the second concerns who can spend it. A hardware wallet is a signing device, not a physical container that holds the Bitcoin blockchain’s coins. Its protection depends on the secrecy of the keys used to authorize spending, which is why a hardware modification can matter even when the mining equipment itself is unaffected.
The advisory provides no recovery guarantee or timeline for returning stolen assets. Its confirmed news is the local reports and preliminary hardware finding, alongside the ongoing inquiry. Using Singapore dollars keeps the reported amount tied to the source instead of introducing an unverified exchange-rate conversion. For readers elsewhere, the practical lesson is about the integrity of the receiving device, not a claim that Singapore’s cases establish losses in their own country.
For a miner collecting long-running payouts, a familiar address is only part of the picture. Review provider advisories, use official assistance if the device is suspect and do not disclose wallet secrets during that process. This is a report on an active investigation and the police’s advice; we have not examined a Ledger device, moved anyone’s assets or verified a particular retailer’s inventory.
Source: Singapore Police Force ↗
Mining calculator ↗
