SECURITY ALERT

The wallet came sealed.

The thief came with it.

Ledger hardware wallets bought from some retail stores in Singapore contained malicious hardware components that could capture users’ recovery phrases or private keys, the Singapore Police Force (SPF) said in an advisory on Wednesday.

At least two cases have been reported since 10 September, with total losses of about S$3.5 million, according to the police.

The components allowed “unauthorised persons to access their cryptocurrency wallets and transfer their assets without their knowledge or consent,” the SPF said.

The finding is preliminary. The police say they are in contact with Ledger, “which is reviewing the affected cases,” and that investigations are ongoing.

The SPF did not name the stores.

What we knew before Wednesday

  • 9 Oct. Ledger pauses sales through a reseller, CryptoBilis, as drains are reported.
  • 11 Oct. Ledger confirms that one affected user’s device contained an unauthorised hardware implant (our first report on the implant). Later that day it says every confirmed case traces to devices sold through CryptoBilis, which it described as a Southeast Asian reseller, and calls the number of impacted devices “limited” (Ledger’s 72-hour update).
  • 13 Oct. Ledger’s security team says the implant reads the 24-word phrase off the screen during setup and sends it out over a mobile network (Ledger’s account of how the implant works). MediaMarkt Saturn pauses Ledger sales after a report from one customer in Germany.
  • 28 Oct, 06:30. The SPF issues its advisory.

The police describe the same kind of attack: a hidden component that captures the phrase, not a flaw in the wallet’s software.

The phrase is everything. Anyone who has it can rebuild the wallet on another device and move the funds, which is why the recovery phrase is the master key.

What the advisory does not say is whether the Singapore stores bought their stock from CryptoBilis, or from somewhere else.

If two separate shops sold tampered devices, how many supply chains were compromised?

What the police advise

The SPF told anyone who suspects a tampered device to stop entering their recovery phrase or making transactions on it, and to contact the wallet maker through official support channels.

Users who think their phrase or keys are compromised should consider moving their remaining assets to a new, trusted wallet with a newly generated recovery phrase, set up on an uncompromised device, the police said.

They also warned against anyone offering “wallet verification or recovery assistance”, including people claiming to be from wallet makers, exchanges or the police.

Protect yourself

  • Buy hardware wallets directly from the manufacturer or a reseller the manufacturer lists as official.
  • Check the maker’s own advisories before setting up a new device, as the SPF recommends.
  • Never type your recovery phrase into a phone, computer or website, and never share it with anyone.
  • If you set up a device from an unofficial seller, treat the phrase as exposed and move funds to a wallet with a new phrase on a device you trust.
  • In Singapore, information can go to the Police Hotline on 1800-255-0000, and the ScamShield Helpline on 1799 can check suspected scams.

Ledger has said the implant does not modify the Secure Element, the protected chip that holds the keys. In Singapore, the police say S$3.5 million was lost anyway.

When the box itself is the attack, who checks the box?

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.