Ledger Flex Bought at Singapore Airport Found With Spyware Module

A Ledger Flex hardware wallet purchased at Singapore’s Changi Airport was found with a concealed surveillance module, raising fresh supply-chain concerns for crypto users worldwide.

Mark Karpelès, the former CEO of Mt. Gox, said the device was bought by user Ben Yorke during the summer and had never been used. Yorke sent it for teardown after noticing suspicious scratches on the casing.

The examination found an additional circuit board and wiring hidden in the bottom of the device. Karpelès said the newer implant could monitor screen communications and capture a wallet’s seed phrase — the recovery words used to restore access to crypto funds — while it was being entered.

The case follows an earlier incident involving Ledger devices sold through a Malaysian distributor, where more than $86 million in crypto assets was stolen. Similar implant traces have also been identified in devices purchased through European authorized distributors and in the Philippines, with the hardware evolving from hand-soldered parts to more discreet manufactured boards.

The findings expand the security risk beyond a single distribution channel and put added scrutiny on how hardware wallets are sourced, handled and sold before reaching users.