Two cases involving Ledger devices bought at certain retail stores in Singapore have been reported since September 10, with police putting victims' combined losses at about S$3.5M.

Preliminary investigations found malicious hardware components inside the devices, able to capture recovery phrases or private keys. That gives attackers a way to access wallets and move funds without the owner's consent. Police are in contact with Ledger, which is reviewing the affected cases.

Earlier in October, Ledger suspended sales across Southeast Asia after finding tampered devices, covering Singapore, Malaysia, Indonesia, Thailand, the Philippines, Vietnam and Hong Kong.

Blockchain analysts estimate total losses from the tampered devices at more than $86M, a figure Ledger has not confirmed.