TLDR
- OneKey’s security team recreated a transaction substitution flaw against an outdated version of Ledger’s Ethereum app.
- Ledger says it patched the issue with app version 1.22.2 before OneKey went public with its findings.
- The bug let a compromised host swap transaction details after a user approved what they saw on screen.
- An attacker needed control of the connection between the device and host, through malware or a hostile webpage.
- Ledger found no evidence anyone exploited the flaw or lost funds because of it.
A dispute broke out this week between Ledger and rival hardware wallet maker OneKey over whether a security flaw counted as a real hack. OneKey’s Anzen security team said it reproduced a transaction replacement bug against Ledger’s Ethereum app.
Ledger pushed back on that framing. The company said the flaw was already fixed in an earlier update before OneKey shared its results.
OneKey founder Yishi Wang posted on August 27 that his team completed the attack in a lab setting. He said the test targeted Ethereum app version 1.22.1.
Ledger confirmed the bug was real. But the company said app version 1.22.2, released on August 13, already contained fixes for the exact issue OneKey demonstrated.
How the Vulnerability Worked
The flaw involved commands sent from a computer or phone to the Ledger device. These commands, called APDUs, tell the device what transaction to sign.
Under the bug, a second command could arrive while a user was still looking at an earlier transaction on their screen. That new command could quietly change the signing details without updating what the screen showed.
In practice, a user might approve a transaction they saw on screen while the device actually signed a different one. Ledger called this a race condition between checking data and using it.
The bug did not expose seed phrases or private keys stored in the secure chip. It only affected what data got signed.
To pull off the attack, someone needed control over the connection between the app and the host device. Ledger listed malware, a hacked wallet app, or a malicious webpage as possible entry points.
The attack could not work on a device that wasn’t plugged in or actively signing something. A user still had to approve a transaction while the attack was running in the background.
Ledger’s Patch Timeline
Ledger says the underlying weakness was introduced in August 2025. It affected Secure SDK versions used to build the Ethereum app, up through version 26.6.0.
The company released app version 1.22.2 on August 13 with state checks meant to block the attack. It followed that with Secure SDK 26.6.1 on August 21, which blocks the bad commands at a deeper level before they reach any app.
Ledger’s Chief Technology Officer Charles Guillemet said reproducing an already patched bug does not amount to hacking the company. He described OneKey’s test as a lab exercise against an outdated app.
Ledger now recommends users run Ethereum app 1.22.3 or later. That version includes the newer SDK protections plus a fix for a separate display issue.
The company said it has not found any evidence the bug was used against real users. No stolen funds have been tied to this issue publicly.
Ledger is telling users to open Ledger Live, update their device apps, and check their Ethereum app version. It noted that updating device firmware alone does not fix apps built with the older SDK.
Other wallet makers using the affected SDK were told to review their own code and rebuild with the patched version. The issue is not limited to Ledger’s own apps.
This story follows a separate case involving rival hardware wallet maker BitBox, which recently patched two unrelated flaws in its firmware installation and Bitcoin address handling. No exploitation was reported in that case either.
