Hardware wallet security incidents

Singapore Police advisory: tampered retail Ledger wallets

Singapore Police reported at least two cases since September 10, 2026 involving Ledger wallets purchased from some retail stores in Singapore. Preliminary investigations found malicious hardware capable of capturing recovery phrases or private keys.

Impact

Police reported about $3.5 million in total losses; the advisory does not explicitly label the currency, while local reporting identifies Singapore dollars. Do not add this to global CryptoBilis estimates: overlap is unknown.

Status / Countermeasure

The advisory names no retailers or models and does not establish a connection to the October 9 drains. Stop using suspected devices, contact official support and follow trusted migration guidance. Investigations were ongoing in the October 28 advisory.

Ledger confirms distribution-channel implants and new retail controls

Ledger confirmed criminals bought genuine devices, added components capable of capturing recovery phrases and reintroduced them through Southeast Asian resellers. Its response reported no compromise of Ledger systems, its OS or Secure Element.

Impact

Authenticating a genuine Secure Element does not prove that the rest of a device enclosure contains no added hardware. Ledger did not confirm a global loss total.

Status / Countermeasure

Ledger suspended reseller/distributor sales in Southeast Asia and Hong Kong, prohibited resale of returned devices and strengthened stock-handling rules. Its examined German retail and warehouse samples were clean; this does not establish the safety of every device.

MediaMarkt sales suspension reported; retail tampering investigated

The Block reported a MediaMarkt Saturn sales suspension after a German customer’s tampering report. This is not proof of confirmed compromised German stock. Ledger’s October 15 response says its examined German retail and warehouse samples were clean.

Impact

Scope and any losses from the German report remain unconfirmed in the primary material reviewed.

Status / Countermeasure

Ledger confirmed a precautionary reseller/distributor suspension in Southeast Asia and Hong Kong and strengthened retail handling rules.

CryptoBilis reseller hardware implants expose recovery phrases

Modified genuine Ledger devices circulated through a Southeast Asian reseller channel. Ledger’s technical statement, reproduced in reporting, described an implant reading recovery phrases from the screen during setup and transmitting them via LTE/eSIM. This bypassed enclosure-level assurances without breaking the Secure Element.

Impact

Third-party investigators published differing loss estimates, including approximately $86M and $93M. Ledger has not confirmed a global total or affected-wallet count.

Status / Countermeasure

Do not initialize or restore a recovery phrase on a suspected device. Contact official Ledger Support. If an exposed phrase controls funds, migrate to a trusted signer with a newly generated phrase. A firmware update or restoring the old phrase elsewhere does not remove exposure.

Seed-generation RNG flaw exploited against affected wallets

An RNG integration error routed vulnerable generation paths to a deterministic software fallback. Approximate 40-bit estimates apply to affected Mk2/Mk3 paths; Mk4/Mk5/Q affected generation was estimated around 72 bits. These are historical firmware-path estimates, not entropy ratings for every current device.

Impact

Multiple theft waves were reported. TRM’s August 5 analysis described approximately 1,816 BTC, then worth about $116M, from more than 5,200 addresses. Early 594 BTC and 1,083 BTC observations were not final totals; these cohorts must not be added together.

Status / Countermeasure

Minimum fixes: Mk2/Mk3 4.2.0; Mk4/Mk5 standard 5.6.0; Q standard 1.5.0Q; Mk4/Mk5 Edge 6.6.0X; Q Edge 6.6.0QX (or later fixed releases in the same track). Update before generating a replacement seed, then follow Coinkite’s migration guide. Updates and passphrases do not repair existing weak seeds. The advisory’s dice exception requires at least 50 fair, independent, private rolls correctly mixed into the final seed.

Postal-mail phishing letters impersonating Ledger

Threat actors mailed physical letters on forged Ledger letterhead — complete with holograms, reference numbers and executive signatures — demanding recipients complete a mandatory 'Authentication Check' by scanning a QR code. The linked site harvested 24-word recovery phrases. Trezor owners received near-identical letters in the same wave.

Impact

Targeting appears to reuse addresses from old customer-data leaks. Any user who entered a recovery phrase lost full control of the wallet.

Status / Countermeasure

Ledger reiterated it never requests recovery phrases. No fix possible beyond user awareness — leaked address data cannot be recalled.

Postal-mail phishing letters impersonating Trezor

The same snail-mail campaign that hit Ledger owners mailed forged Trezor 'security and compliance' letters with QR codes leading to recovery-phrase harvesting sites, styled as a mandatory firmware or transaction check.

Impact

Recovery-phrase theft for anyone who scanned and complied.

Status / Countermeasure

SatoshiLabs warned users publicly. Mitigation is awareness only.

Global-e third-party customer-data breach

Reporting quoting Ledger described unauthorized access to Global-e customer order and contact information. This was a third-party commerce-data incident, not a disclosed wallet or seed compromise.

Impact

Names and contact/order data could enable targeted phishing. The reviewed reports did not establish leaked recovery phrases or compromised Ledger devices.

Status / Countermeasure

Read the dated disclosure and remain wary of unsolicited support or recovery messages.

Reported ~$282M support-impersonation theft

Security reporting described an individual persuaded by fake hardware-wallet support to reveal recovery information. Exact chronology and brand attribution were not established from original investigator evidence in this review.

Impact

Approximately $282M was reported stolen. This was social engineering, not a demonstrated firmware failure; inconsistent per-coin valuations and an unsupported service name have been removed.

Status / Countermeasure

The reviewed security analysis describes tracing and laundering. No completed full recovery was established.

Support-form abuse sends phishing through automated replies

Attackers abused Trezor’s support form to trigger automated replies containing malicious messages. Reporting described form and auto-response abuse, not proof of a stolen seed database.

Impact

Messages appearing to come from support could trick users into exposing recovery information. No aggregate loss was established by the reviewed report.

Status / Countermeasure

Trezor disabled the affected automation and warned users never to share backups.

USPS letter campaign tied to the 2020 customer-data leak

Ledger customers received letters by USPS instructing them to 'validate' their wallet via a QR code or lose access. The letters carried accurate personal details, strongly suggesting the 2020 e-commerce database leak as the source list.

Impact

Recovery-phrase theft for anyone who complied. Individual losses not publicly aggregated.

Status / Countermeasure

Ongoing risk. Ledger maintains a public list of active phishing campaigns.

Legacy entry — individual source not yet rechecked.

Mobile app private-key logging issue

Tangem disclosed that activating with a generated or imported seed could log private-key material in its mobile app. Sending in-app support logs within seven days could expose those logs to support.

Impact

Tangem said fewer than 0.1% could potentially be affected and reported no funds lost or unauthorized access. These are manufacturer-reported findings.

Status / Countermeasure

Update the app and follow Tangem’s affected-user instructions. Seedless activation was not affected by this specific bug.

Third-party support portal breach (~66K users)

An attacker accessed a third-party customer-support tool used by Trezor and contacted ~66,000 users who had opened support tickets, posing as Trezor staff in phishing attempts.

Impact

No funds reported lost. Email addresses and ticket contents exposed.

Status / Countermeasure

Disclosed by Trezor within 24 hours. Vendor access revoked.

Connect Kit supply-chain attack (~$600K drained)

A compromised publishing account distributed malicious Connect Kit versions that injected a drainer into affected dApp front ends. Users of multiple wallet brands were exposed; the hardware devices themselves were not physically compromised.

Impact

Approximately $600,000 was reported stolen. This is an attributed estimate; the exact malicious-code exposure period and affected-dApp count are not asserted here.

Status / Countermeasure

The malicious package was removed. Ledger pledged reimbursement and announced changes to publishing controls.

Unciphered extracts seed from Trezor T via voltage glitching

Security firm Unciphered published a video showing physical extraction of the seed from a passphrase-less Trezor T by glitching the STM32 chip. Requires physical possession, lab equipment and a few hours.

Impact

No remote risk. Anyone storing significant funds on a Trezor One/T without a strong passphrase is vulnerable if the device is lost or stolen.

Status / Countermeasure

Mitigation: BIP-39 passphrase. Cannot be patched on existing devices — chip is not a Secure Element. Trezor Safe 3 / Safe 5 add a Secure Element to address this.

Legacy entry — individual source not yet rechecked.

Ledger Recover key-shard backup controversy

Ledger announced an optional subscription that would let the Secure Element split and encrypt the seed into three shards held by Coincover, Ledger and EscrowTech for ID-based recovery.

Impact

No funds lost, but the disclosure that signed firmware can extract seed-derived material if the user opts in undermined the long-standing 'the seed never leaves the device' marketing and triggered a major trust crisis in the community.

Status / Countermeasure

Feature shipped as opt-in. Open-sourcing of more device code committed in response.

Legacy entry — individual source not yet rechecked.

Unciphered — physical seed extraction from OneKey Mini

Unciphered demonstrated that the OneKey Mini's microcontroller could be glitched to dump the encrypted seed; the PIN could then be brute-forced offline.

Impact

Requires physical access. No remote exploit.

Status / Countermeasure

OneKey shipped a firmware patch that hardened anti-glitching countermeasures and later moved newer models to a Secure Element (OneKey Classic 1S, Pro).

Legacy entry — individual source not yet rechecked.

Mailchimp breach → mass phishing campaign

Attackers compromised Trezor's Mailchimp newsletter list and sent emails directing users to a fake 'Trezor Suite' download that asked for the seed phrase.

Impact

Unknown number of seed phrases harvested; multiple wallets drained.

Status / Countermeasure

Mailchimp account locked. Trezor migrated email infrastructure.

Legacy entry — individual source not yet rechecked.

Kraken Security Labs publishes SafePal S1 findings

Kraken published findings involving tamper detection and firmware handling in SafePal S1. SafePal disputed parts of the assessment and said downgrade protection had been patched.

Impact

The research did not establish user-fund theft. Researchers’ findings and the vendor’s response should be read together.

Status / Countermeasure

Follow current official firmware guidance and review the scope of the research.

E-commerce database breach (~1M emails leaked)

An attacker exploited an API key on Ledger's marketing site and exfiltrated roughly 1 million email addresses, plus ~272,000 detailed records including names, postal addresses and phone numbers of customers who had ordered hardware wallets.

Impact

The dataset was dumped publicly on RaidForums in December 2020. Customers were targeted with waves of phishing emails, SMS smishing and even physical threats sent to their home addresses. Hardware wallets and seed phrases were never compromised, but real-world safety of holders was.

Status / Countermeasure

Customer data remains exposed and can be reused for phishing and threats. A 2024 class-action settlement was not established in this review.

Legacy entry — individual source not yet rechecked.

Kraken Security Labs — STM32 voltage-glitching disclosure

Kraken Security Labs detailed a $75 attack against the Trezor One and Model T using voltage glitching to bypass read protection and recover the encrypted seed.

Impact

Same as above — physical possession required, mitigated by a strong passphrase.

Status / Countermeasure

Acknowledged. Same mitigation path.

Legacy entry — individual source not yet rechecked.

Kraken Security Labs voltage-glitch attack

Kraken Security Labs showed that a stolen KeepKey could be glitched to extract the encrypted seed in about 15 minutes for under $75 in equipment.

Impact

Physical theft scenario only. Passphrase mitigates.

Status / Countermeasure

No silicon-level fix possible on existing units. ShapeShift recommends using a BIP-39 passphrase.

Legacy entry — individual source not yet rechecked.