The tampered Ledger devices in Singapore have been linked to CryptoBilis, a Southeast Asian reseller. The connection was identified during the police investigation into the losses, which totaled S$3.5 million. CryptoBilis is believed to have distributed the compromised devices through retail channels in the region, although the company has not yet issued a public statement.
The pattern is a supply chain attack. Instead of breaking the wallet's software, the attacker opened the device, planted a small malicious component, resealed it, and put it back on a store shelf. This method bypasses the need to hack encrypted firmware or exploit software vulnerabilities. It targets the physical device before it ever reaches the buyer.
That component captures the recovery phrase when the buyer first sets up the wallet. From there the attacker can reconstruct and drain the wallet at any time. The component is designed to be stealthy, often embedded within the device's circuitry or attached to the microcontroller. It may not be visible to the naked eye, making detection difficult without specialized equipment.
It is a warning that even hardware wallets, long considered the safest way to store crypto, can be compromised before they ever reach the buyer. Hardware wallets are designed to keep private keys offline and isolated from internet connected devices. However, if the hardware itself is modified, those protections are undermined. This incident highlights the importance of purchasing from trusted sources and inspecting devices carefully.
Supply chain attacks are not new, but they are increasingly targeting cryptocurrency users. In 2020, a similar attack involved modified Ledger wallets sold through a third party reseller. More recently, attackers have used fake websites and phishing emails to trick users into downloading malicious software. The CryptoBilis case shows that physical tampering remains a viable threat.
Ledger has suspended sales across Southeast Asia and is reviewing the cases with police. The company has stated that it is cooperating fully with authorities and is working to identify any other affected devices. Customers who purchased Ledger devices in the region are advised to check for signs of tampering and to contact Ledger support if they have concerns.
For consumers, the lesson is clear: verify the source of your hardware wallet and inspect it thoroughly. If you suspect tampering, do not use the device. Create a new wallet with a fresh recovery phrase and transfer your funds. Never reuse a recovery phrase that may have been exposed.
Authorities are continuing their investigation and have not ruled out additional arrests. They urge anyone who purchased a Ledger device from CryptoBilis or other unauthorized resellers to come forward if they notice suspicious activity. The case serves as a reminder that security in the crypto space requires constant vigilance, both online and offline.