Singapore Police: Tampered Hardware Wallets Linked to Approximately S$3.5 Million in Losses

Singapore authorities are investigating a suspected hardware wallet supply chain compromise after at least two users reportedly lost a combined total of approximately S$3.5 million in crypto assets.

According to an advisory issued by the Singapore Police Force, the cases were reported from September 10 onward. The affected individuals had purchased hardware wallets through selected retail channels in Singapore. Preliminary findings indicate that some devices may have contained malicious hardware components capable of capturing recovery phrases or private keys.

The investigation remains ongoing. Authorities have not disclosed the specific retailers involved or explained how the suspected components entered the distribution process.

How a Tampered Device Can Put Crypto Assets at Risk

Hardware wallets are designed to keep private keys isolated from internet-connected devices. However, this protection depends on the integrity of the device itself and the security of the supply chain through which it reaches the user.

A compromised device could potentially:

• Capture a recovery phrase when it is entered during setup
• Expose or copy private key material
• Display misleading wallet addresses during a transaction
• Redirect transactions to an attacker-controlled address
• Enable unauthorized asset transfers after the user has completed setup

This type of incident is different from a conventional phishing attack. The victim may follow what appears to be a normal wallet initialization process, while the underlying device has already been modified before purchase.

For this reason, a hardware wallet should not be treated as automatically trustworthy simply because it is sold in physical packaging. Authenticity verification, secure initialization, firmware validation, and careful purchasing decisions all form part of the security model.

The Most Important Warning: Never Enter a Recovery Phrase on a Suspicious Device

The Singapore Police Force has advised users not to enter a recovery phrase or continue transacting on a device suspected of being altered.

A recovery phrase is effectively the master backup for a wallet. Anyone who obtains it may be able to restore the wallet on another device and move the associated assets. Blockchain transactions are generally irreversible, so waiting to see whether suspicious activity occurs can increase the potential loss.

Users should take immediate action if a device:

• Was purchased through an unofficial or unclear distribution channel
• Shows signs of packaging or hardware tampering
• Behaves differently from the manufacturer’s documented setup process
• Requests sensitive information in an unusual way
• Displays unexpected wallet addresses or transaction details
• Has already been associated with unauthorized transfers

Users should also remember that legitimate support teams will not ask for a complete recovery phrase or private key.

What Affected Users Should Do

If a recovery phrase or private key may have been exposed, the affected wallet should be considered permanently compromised. Changing a PIN or reinstalling an application does not generate new cryptographic credentials.

A safer response is to:

1. Stop using the suspected device immediately.
2. Avoid entering the existing recovery phrase into the same device.
3. Obtain a verified, unaffected wallet from a trusted distribution channel.
4. Generate a completely new wallet and recovery phrase.
5. Transfer remaining assets to the new wallet.
6. Review token approvals and revoke unnecessary permissions where appropriate.
7. Preserve purchase records, device information, transaction hashes, and relevant communications.
8. Report suspected losses to local law enforcement and the wallet manufacturer.

For Ethereum and other smart contract networks, moving native assets alone may not be sufficient. Users should also check token balances, NFT holdings, staking positions, and active contract approvals. A compromised key can expose all accounts derived from the same recovery phrase.

Supply Chain Security Is Part of Self-Custody

The incident highlights an important principle in cryptocurrency security: self-custody removes reliance on centralized intermediaries, but it also places greater responsibility on the user.

Security risks can emerge at multiple points, including:

• Manufacturing
• Device assembly
• Firmware distribution
• Retail storage
• Shipping and delivery
• Initial setup
• Recovery phrase generation
• Transaction confirmation

A wallet purchased from an unauthorized seller may carry risks that are difficult to identify through ordinary visual inspection. Even sealed packaging is not an absolute guarantee if a product has passed through an untrusted supply chain.

Users should prioritize official purchasing channels, verify the device using the manufacturer’s official procedures, update firmware only through trusted software, and complete the initial setup in a private environment. Recovery phrases should be generated by the wallet itself and recorded offline. They should never be photographed, stored in cloud notes, sent through messaging applications, or typed into websites.

The National Institute of Standards and Technology’s digital identity guidance also reinforces the broader security principle that authentication secrets must be protected against unauthorized disclosure. In crypto, this principle is especially critical because control of the key generally means control of the assets.

Why Transaction Verification Still Matters

Even when a wallet is functioning normally, users should verify the destination address and transaction details on the device’s trusted display before approving a transfer.

Malware on a computer or mobile phone can replace a copied address with an attacker’s address. A secure signing device can reduce this risk, but only if the user checks the information presented for approval rather than confirming transactions automatically.

For larger transfers, users may consider:

• Sending a small test transaction first
• Comparing the full destination address
• Using address books or whitelisting features where available
• Separating long-term holdings from active trading funds
• Maintaining separate wallets for different risk profiles
• Reviewing network fees and contract permissions before signing

These practices cannot eliminate every threat, but they can reduce the impact of phishing, clipboard malware, malicious contracts, and operational mistakes.

What This Means for Hardware Wallet Buyers

The Singapore investigation does not suggest that all hardware wallets are compromised. It does, however, demonstrate why device provenance and secure setup are essential parts of digital asset protection.

Before purchasing a device, users should evaluate:

• Whether the seller is an authorized or clearly verifiable distributor
• Whether the package and device show signs of modification
• Whether the wallet supports secure, locally generated recovery phrases
• Whether firmware authenticity can be independently verified
• Whether transaction details are displayed clearly before signing
• Whether the manufacturer publishes security advisories and response procedures

Users should also follow official security updates and local law enforcement guidance while the investigation continues. The Singapore Police Force’s official media and advisory channels remain the appropriate place to check for verified updates regarding the reported cases.

A Practical Security Checklist

For everyday crypto users, the following checklist can help reduce hardware wallet and private key risks:

• Buy only through trusted and verifiable channels.
• Inspect the packaging and device before use.
• Initialize the wallet yourself in a private setting.
• Never accept a recovery phrase supplied by another person.
• Never share a recovery phrase or private key with anyone.
• Keep backup words offline and protected from fire, water, and unauthorized access.
• Confirm addresses and transaction details on the wallet’s own display.
• Use a separate wallet for experimental applications and higher-risk decentralized finance activity.
• Move assets immediately if a seed phrase may have been exposed.
• Keep transaction records and device details if an incident occurs.

For users seeking a hardware wallet with a focus on secure key isolation, transparent transaction confirmation, and user-controlled recovery, OneKey can be considered as part of a broader self-custody strategy. However, no device can replace sound operational security: the safest wallet is still undermined if its recovery phrase is exposed, entered into an untrusted device, or stored carelessly.

The suspected losses in Singapore are a reminder that crypto security begins before a wallet is connected. Verifying the source of the device, protecting the recovery phrase, and treating unexpected hardware behavior as a serious warning can make the difference between secure self-custody and irreversible loss.