Respond to wallet and signing incidents
Singapore Police said on 28 October 2026 that, since 10 September, at least two reported cases involving tampered Ledger hardware wallets purchased from some retail stores had caused about S$3.5 million in total losses. Preliminary investigations found malicious hardware components capable of capturing recovery phrases or private keys; police investigations remain ongoing and Ledger is reviewing the cases. If a device may be affected, do not enter a recovery phrase or conduct further transactions on it, and contact the provider through an independently verified official support channel. If a recovery phrase or private key may already be compromised, the police advisory says to consider moving remaining assets using an uncompromised device to a new trusted wallet with a newly generated recovery phrase. These are preliminary findings concerning reported devices, not evidence that all retail hardware wallets are affected.
See evidence →Stop further approvals and contact your established security or custody support. Work from a known clean device. If physical coercion is involved, secure people before attempting financial containment.
Identify the likely problem
| What happened | Initial response |
|---|---|
| Suspicious connection only | Stop interaction and inspect what was actually signed; connection alone is not proof of key theft |
| Unwanted token approval or permit | Identify the exact permission and use a verified, chain appropriate containment process |
| Seed or private key exposed | Treat every affected account under that secret as compromised; plan movement to new independently generated keys |
| Signer or administrator compromised | Review threshold, owners, modules, recovery, delegates and pending actions with the custody team |
| Exchange or custodian account takeover | Contact the provider immediately through verified support and request available restrictions |
Revoking an approval does not repair a stolen private key. Disconnecting a site does not necessarily revoke permissions. A new account derived from the same compromised seed is not a new security boundary. [S16] [S17]
Contain without making the problem worse
Use the reviewed emergency procedure and independently verify a clean destination. Conventional self custody usually requires retiring wallets with compromised keys, not changing an app password. Smart accounts and institutional arrangements need configuration specific decisions.
Do not repeatedly add gas to a compromised wallet: an automated sweeper may remove it before recovery completes. Obtain competent help for the chain. Avoid unsolicited rescue scripts, messages and sites requesting recovery words. [S17]
Check for cross chain exposure, additional accounts, pending transactions, approvals, delegates and automation. Determine which authority is actually compromised. Do not rush to change multisignature or recovery settings in a way that locks out legitimate owners.
Report while containment proceeds
Record the chain, token, transaction hashes, addresses, amounts, times and time zone, suspicious site or message, and account identifiers. A trusted person can collect these while the technical team works.
Promptly contact relevant exchanges, custodians and police through official channels. Freezing is sometimes possible, never guaranteed. A self custody wallet vendor generally cannot reverse an executed blockchain transaction. [S17]
Do not pay an “unlock,” “validation,” “tax” or guaranteed recovery fee demanded by a stranger. Private recovery companies cannot issue seizure orders. Verify credentials and legal scope before engaging professional help. [S08]
If you just ran unfamiliar software: stop asset use on that device. Disconnect from the network where safe and practical; contact professional responders. Preserve messages. Do not rerun the file or rush to reinstall and destroy evidence. Use a known clean device for financial containment. [S57]