A hardware wallet is the thing Indian investors are told to buy once their crypto stops being pocket money. This week showed the weak point is not the wallet’s chip but the shelf it was bought from. On 28 October the Singapore Police Force said that Ledger wallets bought from some retail stores in Singapore contained malicious hardware that could capture recovery phrases. At least two victims lost about S$3.5 million between them since 10 September.
So, is it still safe to buy a Ledger in India? Yes, with two conditions: where you buy it matters, and you check the device before you type a single recovery word into it.
It was not one bad reseller
When the story broke on 9 October it looked like a single rogue Southeast Asian reseller, CryptoBilis, which we covered at the time. The picture is now wider. A public tracker run by Mark Karpelès lists 17 tampered or counterfeit Ledgers from 9 named sellers. We grouped them by where they were bought:
| Where bought | Type of seller | What was found |
|---|---|---|
| CryptoBilis, Malaysia | Reseller (3 devices) | Implant |
| Challenger VivoCity and Metapod Changi Airport, Singapore | Electronics stores | Implant |
| MediaMarkt, Germany | Electronics chain (3 reports) | Implant (one pending) |
| Amazon Japan, third-party seller based in China | Marketplace | Implant |
| Yahoo! Flea Market, Japan | Second-hand marketplace | Implant |
| Ozon, Russia | Marketplace | Implant |
| JD.com, China | Marketplace | Counterfeit |
| Lazada sellers, Thailand | Marketplace | Implant |
That is 7 countries, and the list covers only cases people made public. The tracker says the implants found so far carry their own antenna and read the recovery phrase off the screen. Ledger has paused sales across Singapore, Malaysia, Indonesia, Thailand, the Philippines, Vietnam and Hong Kong.
No Indian seller appears on the list. That is not a clean bill of health. The pattern is about third-party sellers on big marketplaces and shops far from the factory, and those exist here too.
The size of one mistake, in rupees
Our own conversion, at USD/INR 95.22 and USD/SGD 1.2821 on 28 October 2026 (Frankfurter/ECB rates):
- The two Singapore cases: S$3.5 million is about ₹26 crore, or roughly ₹13 crore per victim on average.
- The wider drain: blockchain analysts put losses at more than US$86 million, per The Straits Times, about ₹819 crore. Ledger said it could not confirm that figure.
- Bitquery counted about 324 wallets drained on 9 October, the tracker notes. If the US$86 million estimate holds, that averages about US$265,000, or ₹2.5 crore per wallet. One person can own several wallets, so the loss per victim is likely higher.
A hardware wallet costs a few thousand rupees. The people who lost money were exactly the ones holding enough to justify buying one.
A five-step check before you set it up
- Buy from Ledger directly or a seller Ledger lists as authorised. Skip “best price” third-party listings, open-box deals and second-hand units, even on well-known marketplaces.
- Never accept a device with a recovery phrase already printed or filled in. A genuine wallet makes you generate a new phrase on the device itself.
- Run the genuine-device check in Ledger’s own app before moving funds. Note that the tracker’s implants sit beside the real chip, so a pass does not rule out an add-on board.
- Look inside if you can. The tracker says opening the case takes about five minutes and shows what to look for: extra wires, an added board or an antenna.
- Test with a small amount first. Send a few hundred rupees in, wait a day or two, then move the rest.
If anything looks wrong, Singapore police advise not entering your recovery phrase and moving any funds to a new wallet with a freshly generated phrase on a device you trust.
What it means for Indian investors
Losing crypto to theft is painful twice in India. The 30% tax regime on virtual digital assets does not let you set a crypto loss against salary or other income, so there is no tax cushion. Our crypto loss set-off calculator shows what the rules do and don’t allow. Self-custody is still sound for long-term holders, as our Bitcoin price in INR page shows how much some of those holdings are now worth. Just treat the purchase as the riskiest step, not the safest.
BtcMedia verdict: buy the wallet the way you’d buy gold jewellery, from a known source with a receipt, and verify it before you trust it.
FAQ
Is Ledger itself hacked? No. Police and the tracker describe hardware added to devices after they left the factory, plus some counterfeits. The weak link was the sales channel.
Were any tampered Ledgers sold in India? None appears on the public tracker as of 29 October 2026. That list covers only cases made public, so check any device you own.
I already use a Ledger bought from a marketplace. What should I do? Check where it came from. If you have any doubt, move funds to a new wallet with a freshly generated recovery phrase on a device you trust.
How we calculated this: S$ and US$ figures from Singapore police, The Straits Times and the Karpelès tracker; converted at Frankfurter (ECB) rates for 28 October 2026, checked at 2:45 PM IST. This is not financial advice.