Singapore police issued practical guidance after the tampered Ledger wallet losses, and it applies to every hardware wallet buyer. The advisory came in late October 2026 following the discovery that compromised devices had been sold through retail stores in Singapore, leading to millions of dollars in losses. While the specific incident involved Ledger wallets, the principles outlined by authorities are universal and should be followed by anyone purchasing any brand of hardware wallet.
The first rule is to only buy from the official manufacturer or an authorized channel. Avoid third party sellers you cannot verify. This means purchasing directly from the company's website or from a reputable retailer that is officially listed by the manufacturer. Marketplaces and second hand sellers introduce risk because the chain of custody is unclear. Even if a device appears new, it may have been opened, modified, and resealed before reaching you.
Second, check the packaging and the device for signs of tampering. A scratched seal, a loose casing, or glue residue are red flags. When you receive a hardware wallet, inspect the box carefully. The seal should be intact and free from cuts or scratches. The device itself should not have any signs of having been opened, such as misaligned seams, loose parts, or leftover adhesive. If anything looks suspicious, do not proceed.
Third, if you suspect a device has been opened, do not set it up. Transfer any funds to a brand new wallet created with a freshly generated recovery phrase. Setting up a compromised device could expose your recovery phrase to an attacker. Instead, contact the manufacturer and report the issue. If you already have funds on the device, move them immediately to a new wallet that you know is secure.
The key rule has not changed. Your recovery phrase is the wallet. Anyone who gets it owns everything. This is why hardware wallet security ultimately depends on keeping your recovery phrase secret. Even the most secure device cannot protect you if your phrase is compromised. Never enter your recovery phrase into a computer or phone, and never share it with anyone. Store it offline in a secure location.
These guidelines are especially important in light of the Singapore incident, where attackers modified devices at the supply chain level. The malicious components captured recovery phrases during setup, allowing attackers to drain wallets remotely. By following the steps above, you can reduce the risk of falling victim to similar attacks.
Hardware wallets remain one of the safest ways to store cryptocurrency, but they are not immune to tampering. The Singapore police advisory serves as a reminder that security is a process, not just a product. Buyers must remain vigilant from the moment they purchase a device to the moment they store their first coins.
In addition to the three main points, authorities recommend keeping your device firmware up to date and verifying the integrity of the device using the manufacturer's official software. If the software detects any anomalies, do not ignore them. Always download software only from the official website.
Finally, consider the source of your purchase carefully. If a deal seems too good to be true, it probably is. Authorized resellers may charge a slight premium, but the peace of mind is worth it. By staying informed and cautious, you can protect your assets from supply chain attacks and other threats.