The Singapore Police Force says at least two cases have been reported since Sept 10, with total losses of about S$3.5 million. Preliminary investigations found that Ledger devices bought from some retail stores in Singapore contained malicious hardware components able to capture recovery phrases or private keys, letting someone else move the funds. Police are in contact with Ledger, which is reviewing the cases. The advisory does not name the stores or say how the devices were altered.

Context: this is the same class of attack Ledger confirmed on Oct 10 to 13 for devices sold by the Southeast Asian reseller CryptoBilis, where an implant read the 24-word phrase off the screen during setup. The police advisory does not say whether the Singapore devices came through that reseller.

What to do: buy hardware wallets only from the maker or a reseller it lists; do not enter a recovery phrase on a device you suspect; if you set one up from an unofficial seller, move funds to a new device with a newly generated phrase. Police also warn against anyone offering "wallet verification or recovery" help, including people claiming to be police.