Crypto: Singapore investigates Ledger devices modified without manufacturer's knowledge

The trap was hidden in the box. Singapore police warn of tampered Ledger devices purchased in physical stores. Since September 10, at least two cases have been reported, with cumulative losses of around S$3.5 million. Initial investigations reveal the presence of hardware components capable of capturing recovery phrases or users' private keys. We take stock of this information.

Police have documented at least two cases involving tampered Ledgers sold in stores in Singapore.

Malicious components can steal information needed to access funds.

Ledger describes an attack on its distribution channel and has requested a suspension of sales at its resellers in Southeast Asia and Hong Kong.

Resetting a suspicious device is not enough to eliminate a hardware implant.

In its warning of October 28, the police indicate that the components discovered could allow third parties to transfer cryptocurrencies without the authorization of their owner. The investigation remains ongoing, and authorities are in contact with Ledger, who is examining the cases concerned.

The manufacturer described, on October 15, an attack against devices distributed in Southeast Asia. According to its statement, a criminal group purchased genuine Ledgers, opened the cases and added hidden components to intercept the recovery phrase during setup. The modified devices then re-entered the reseller circuit.

The victim could therefore generate his recovery phrase himself while having it captured by the implant. The scenario goes beyond that of a device delivered with words already written on a sheet.

Ledger claims its chip, operating system and servers were not compromised. The company places the alteration after the devices left its control. This explanation distinguishes the safety of the original components from that of the product given to the buyer.

Faced with a hardware modification, generating a new sentence on the same device does not constitute sufficient protection: the added component remains present. A reset or an authenticity check should therefore not be presented as a guarantee against this type of attack.

Police recommend not entering recovery phrases or making further transactions on a suspicious device, and contact the manufacturer through its official channels. If the keys or phrase appear compromised, she advises considering transferring remaining assets to a trusted wallet with a new phrase generated on an uncompromised device.

For its part, Ledger has asked its resellers and distributors to suspend sales in Southeast Asia and Hong Kong. The manufacturer has also strengthened its instructions: no returned device must be put back on sale, even if it appears new, and stocks must remain off the shelves accessible to customers.