Singapore police say at least two cases involving tampered Ledger hardware wallets have been reported since Sept. 10, with combined losses of about 3.5 million Singapore dollars ($2.7 million), placing local reports almost a month before the wider incident became public.
In an advisory published Wednesday, the Singapore Police Force said preliminary investigations found malicious hardware components in Ledger wallets purchased from some retail stores in Singapore.
The disclosure adds both a local loss figure and an earlier reporting date to the incident, which surfaced publicly on Oct. 9 following reports of losses involving devices sold through CryptoBilis, an authorized Ledger reseller in Indonesia, Malaysia and the Philippines.
Days later, former Mt. Gox CEO Mark Karpelès said that a Ledger Flex purchased at Singapore’s airport contained a spy implant.
Another Ledger user claimed to have a tampered device bought from local IT retailer Challenger. The user said he was later sent a new device from Ledger.
On Oct. 13, Ledger said it has asked retailers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend sales of Ledger devices as investigations are ongoing.
Singapore police said it is in contact with Ledger, which is reviewing the affected cases, while police investigations are ongoing.
Related: Ledger’s early implant warnings deserved more action, Karpelès says
