Make signing a deliberate activity
Singapore Police said on 28 October 2026 that, since 10 September, at least two reported cases involving tampered Ledger hardware wallets purchased from some retail stores had caused about S$3.5 million in total losses. Preliminary investigations found malicious hardware components capable of capturing recovery phrases or private keys; police investigations remain ongoing and Ledger is reviewing the cases. If a device may be affected, do not enter a recovery phrase or conduct further transactions on it, and contact the provider through an independently verified official support channel. If a recovery phrase or private key may already be compromised, the police advisory says to consider moving remaining assets using an uncompromised device to a new trusted wallet with a newly generated recovery phrase. These are preliminary findings concerning reported devices, not evidence that all retail hardware wallets are affected.
See evidence →Treat signing like authorising a bank transfer or a contract. A familiar logo, a successful simulation or a hardware device does not establish that the underlying action is safe.
A short signing routine
- Confirm why the transaction is needed and whether it can wait until you are rested, private and using your normal setup.
- Open the service through a previously verified route. Do not follow a direct message, sponsored search result or urgent “security update.”
- Independently verify the full receiving address, network, asset, amount and any memo or tag. Do not copy an address from transaction history just because the beginning and end look familiar.
- Read the action and permissions. If you cannot explain what the signature authorises, stop and ask an appropriately trusted specialist.
- For a new destination, use an appropriate small test and independently confirm receipt. A test checks part of the process; it does not prove the recipient is honest or protect against a later address change.
- For material transactions, use a second reviewer who obtains recipient details independently. Keep an approval record without private keys or recovery words.
Permissions deserve the same care as transfers
A token approval can allow a contract to spend tokens later. Review spending limits and revoke permissions that are no longer required, using a verified tool appropriate to the chain and wallet. Disconnecting a website session is not the same as revoking on chain permissions. [S16]
Message signatures, permits, account delegation and batched transactions can have consequences beyond the visible transfer. Ask what assets and future actions the signature covers. Do not blind sign a transaction you cannot evaluate simply to get through an interface.
Keep reserve signing boring
Use a supported, updated setup dedicated to its purpose. Obtain hardware from the manufacturer or an authorised source and follow its authenticity and initialization instructions. Never accept a wallet already initialized with words supplied by a seller, host or “support” agent.
Keep reserve signing away from entertainment, travel fatigue, demo sites, games, experimental software and unsolicited remote support. Any trading automation should have limited permissions, a known owner and a way to suspend it safely.
Stop triggers: changed payment details, unexpected approval, pressure to act in minutes, a new browser extension, an unexplained device prompt, or instructions to bypass your usual reviewer. A paused transaction is an acceptable outcome.