Singapore Police Find Malicious Components in Some Ledger Wallets

Singapore police said preliminary investigations found malicious hardware components in some Ledger wallets sold through retail stores in Singapore, linking the devices to at least two reported cases since Sept. 10 and losses of about 3.5 million in an unspecified currency.

The Singapore Police Force (SPF) said the components could capture recovery phrases or private keys. The police advisory did not name the retailers or say whether the local cases were connected to CryptoBilis. The investigation is ongoing, and Ledger is reviewing the cases.

Separately, Arkham attributed an estimated $95.35 million in thefts across 1,486 addresses between Oct. 7 and 9 to a CryptoBilis-linked Ledger drainer. On Oct. 29, tagged addresses held $30.44 million, including $10 million frozen, while $13.84 million moved in the preceding 48 hours. The estimate is not a loss total confirmed by Ledger.

Ledger said Oct. 15 that the devices were modified after leaving its control and that its chip, operating system and servers were not compromised.