Tampered Ledger Wallet? 7-Point Hardware Wallet Check

Some Ledger hardware wallets sold through resellers in Southeast Asia had a hidden chip inside that read the 24-word recovery phrase off the screen and sent it to thieves. Singapore police say at least two local cases since 10 September cost about S$3.5 million. A tampered Ledger wallet can pass the box check, the official Genuine Check and a self-generated seed, so where you bought it matters more than anything you can test at home. Below: what police and Ledger confirmed, a 7-point check, and what to do if you bought one in the region.

What happened: the Singapore police case and the regional pause

On 28 October 2026 the Singapore Police Force issued an advisory on tampered crypto hardware wallets. The key points:

• At least two cases reported since 10 September 2026, with total losses of about $3.5 million. Local outlets report it as S$3.5 million. Cointelegraph converts that to about US$2.7 million.
• Bought in shops, not online scams. Preliminary investigations found Ledger wallets bought from some retail stores in Singapore contained malicious hardware that could capture recovery phrases or private keys. Police did not name the stores, and neither do we.
• Ledger is reviewing. Police are in contact with Ledger. According to The Star / Straits Times, Ledger said it could not confirm how many people were affected or how much was lost.

Decrypt reports that on 13 October Ledger asked resellers and distributors in seven Asian markets to suspend sales and pull devices from shelves. Ledger has said all its confirmed fund losses involve devices sold by one Southeast Asian reseller, and that it has not verified a drain linked to a device bought outside the region.

A bigger number is circulating too. An onchain investigator traced more than US$86 million in suspected thefts. Ledger has not verified that figure, so treat it as an estimate.

Our maths: what the numbers say

We ran two quick sums on 2 Nov 2026:

• S$3.5 million ÷ 2 reported cases ≈ S$1.75 million per case on average. These were not small wallets.
• US$2.7 million ÷ US$86 million ≈ 3%. Singapore’s police-confirmed losses are a small slice of the unverified regional estimate. Treat the police figure as a floor.

Takeaway: This is a supply-chain attack, confirmed by police and Ledger. It is not a rumour, and the losses per reported case in Singapore averaged well over a million dollars.

Why the usual checks don’t catch this implant

Here is how it worked, per Ledger’s Donjon security team as reported by Decrypt. An extra component sat inside the case and watched the screen. When the device showed the recovery-phrase screens during setup, the implant decoded the words and sent them out over a mobile (LTE) connection using a built-in eSIM.

It did not touch the Secure Element, the operating system or transactions. Everything looked normal until the funds were gone.

That breaks most “is my Ledger safe?” advice you’ll find online:

Takeaway: No check you can run at home proves a hardware wallet has no implant. The buying channel is your real defence.

The 7-point hardware wallet check (before you put a cent on it)

Use it for any new hardware wallet.

1. Buy direct from the manufacturer. Ledger recommends buying from Ledger or an Authorised Reseller. Right now, in the seven paused markets, direct is the only route Ledger has called safe. Skip marketplace sellers and second-hand units.
2. Treat the box as proof of nothing. A torn seal is a reason to reject a device. An intact one is not a reason to trust it. If a package looks opened or altered, Ledger says don’t use it and contact Ledger Support.
3. Reject any pre-set seed, PIN or scratch card. Ledger says: “A legitimate Ledger device never comes with a recovery phrase or PIN code pre-configured. Ever.” A printed seed sheet or scratch-off PIN in the box means someone else controls that wallet.
4. Generate the seed on the device yourself. Write the 24 words on paper. Never type them into a phone, PC or website. Remember this beats pre-filled scams, not implants.
5. Run the official Genuine Check. Do it in the Ledger Wallet (Ledger Live) app downloaded from Ledger’s own website. If it fails, stop. If it passes, you’ve ruled out a counterfeit, not an implant.
6. Send a small test transaction first. Receive a small amount, then send it back out, checking the full address on the device screen each time. This catches setup mistakes and address tricks before real money moves.
7. Bought from a reseller in Southeast Asia? Don’t load it. If it’s still unopened or not set up, leave it and contact Ledger Support. If you’re already using it, follow the steps in the next section.

Takeaway: Points 2 to 6 stop the everyday scams. Only point 1, buying direct, protects you from a hidden chip.

Bought a Ledger in Southeast Asia since September? Do this

These steps combine the Singapore police advisory with Ledger’s guidance as reported by Decrypt and Unchained:

1. Not set up yet? Don’t start. Don’t enter or restore any recovery phrase on it. Contact Ledger Support through its official website.
2. Already using it? Stop using it. Police advise not entering your recovery phrase or making further transactions on a device you suspect.
3. Move your funds to a fresh wallet. Set up a new wallet with a newly generated recovery phrase on a device you trust, such as one bought direct from the manufacturer. Never reuse the old phrase; it may already be stolen.
4. Don’t open it or ship it. Ledger says not to open the device or send it to anyone before speaking with Ledger Support or police.
5. Lost funds? Report it. Tell local police (numbers below) and Ledger Support, so your case is counted.

Then expect the second wave. Police warn you to be wary of unsolicited offers of “wallet verification” or “recovery help”. Anyone who promises to trace and return stolen crypto for a fee is very likely running a crypto recovery scam that targets people after a loss. Police, exchanges and Ledger will never ask for your seed phrase.

Takeaway: New device, new seed, old device in a drawer. Then report, and ignore recovery offers.

Is it the device or a phishing scam?

A drained wallet doesn’t always mean a hacked chip. Before you blame the hardware, compare the signs:

Ledger’s own phishing page says it will never contact you by text message, phone call or social media DM. It also says the only place to download the official app is its website.

Worried owners are searching for help right now. We tested it on 2 Nov 2026. A web search for Ledger’s genuineness check returned 20 results. Fourteen were third-party-hosted pages with “Ledger start”-style names, not ledger.com. We didn’t open the lookalikes, and you shouldn’t either. The same trick shows up with banks, as our fake bank login page check explains.

Takeaway: If you typed your seed anywhere except the device, assume phishing. Type ledger.com yourself; don’t click a search result.

Why this matters if you hold USDT for casino deposits

Many players in Asia hold USDT or other crypto for casino deposits. A hardware wallet is a sensible place for it, as long as the wallet is clean. Crypto transfers generally can’t be reversed, so a drained wallet usually stays drained.

If that’s you, three more reads:

• Our USDT casino deposit risks checklist covers the traps before you send.
• Check the exchange you use with is Binance legal in Malaysia, and see what happened in the Binance hack refund and withdrawal guide.
• Lock down the other end with our 10-minute casino account security checklist, and only deposit with sites that pass our unlicensed online casino check.

Takeaway: A safe wallet won’t save you from an unsafe casino, and a safe casino won’t save you from a bugged wallet. Check both.

Where to report (verified 2 Nov 2026)

We checked each number on the linked page on 2 Nov 2026. In an emergency, call your local emergency number.

For other countries and a step-by-step reporting guide, use our scam reporting tool.

Takeaway: Report fast, even if you think the money is gone. Police need cases to connect the dots.

FAQ

How do I check if my hardware wallet is tampered?

You can’t fully check at home. Ledger says its Genuine Check can’t detect added hardware if the Secure Element is intact. Reject any device with a pre-set seed, PIN or damaged box, and run the Genuine Check. The real protection is buying direct.

Is my Ledger safe if I bought it from Ledger’s website?

Ledger says its direct sales channel is safe to use, and its confirmed losses involve devices sold by a reseller in Southeast Asia. Still keep your seed on the device only.

What did Singapore police say about Ledger wallets?

On 28 October 2026 the SPF said at least two cases since 10 September involved about S$3.5 million in losses. Ledger wallets bought from some retail stores in Singapore contained malicious hardware that could capture recovery phrases. Police did not name the stores, and investigations are ongoing.

How do I buy a hardware wallet safely in Malaysia?

Buy direct from the manufacturer’s official store. Ledger has asked resellers in Malaysia and six other markets to pause sales. Avoid marketplace sellers and second-hand units, and reject any box with a pre-filled seed or PIN.

Can someone recover crypto stolen through a tampered wallet?

Be very careful. Crypto transfers generally can’t be reversed, and police warn about unsolicited offers of recovery help. Report to police and Ledger Support. Never pay a “recovery agent” or share your seed phrase.

HotStakes is an independent directory. Some links on this site are affiliate links; we may earn a commission at no cost to you, and it never changes our rankings. Gambling involves risk — only play with money you can afford to lose, and if it stops being fun, seek help. This article is general information, not legal advice. Read our full disclaimer.