SINGAPORE POLICE SAY TAMPERED LEDGERS CAME FROM LOCAL RETAIL STORES — TWO CASES SINCE SEPTEMBER 10, 29 DAYS BEFORE LEDGER’S WARNING — ABOUT S$3.5 MILLION LOST, NO STORES NAMED

The Singapore Police Force issued an advisory at 2:30 p.m. local time on October 28, 2026. It says: “Since 10 September 2026, at least two cases have been reported, with total losses amounting to about $3.5 million.” That is Singapore dollars; Cointelegraph puts it at about US$2.7 million. Police say preliminary checks found Ledger wallets that “contained malicious hardware components,” bought “from some retail stores in Singapore.”

Until now this story had one door. Ledger’s October 9 alert named CryptoBilis, a reseller Cointelegraph places in Indonesia, Malaysia and the Philippines. The police do not name the Singapore stores and do not say the devices came through CryptoBilis. Cointelegraph reports that one buyer named the local retailer Challenger, and that Mark Karpelès said a Ledger Flex he bought at Singapore’s airport held an implant. Neither claim comes from the police.

The dates matter. The first Singapore case was reported on September 10, per Cointelegraph, 29 days before Ledger’s public warning. Ledger put Singapore on its October 13 list of seven markets told to stop selling. A hardware wallet is supposed to mean the keys never leave your hand. A part that can capture your recovery words turns that into trust in every hand the box passed through. And for bitcoin there is no one to call: the CryptoBilis drain left 203.79 BTC in addresses nobody could freeze.

Two cases and a loss figure are all the police gave. No device count, no store names, no word on which coins left. Their advice is the right one: if you typed your words into a device you now doubt, make a new seed on a device you trust and move the coins. At the time of this writing, bitcoin was $77,593.