Ledger rejected claims that it had been hacked after OneKey's Anzen security team reproduced a transaction replacement flaw against an outdated version of Ledger's Ethereum application.
Ledger Ethereum Flaw Broke the Trusted Display Guarantee
The vulnerability involved communication between a Ledger device and its connected host. Ledger applications receive instructions called Application Protocol Data Unit commands, or APDUs, from wallet software, webpages or other interfaces. An affected application could accept a second APDU command while the user was reviewing an earlier operation on the device screen. The new command could overwrite signing parameters stored in shared memory without updating the displayed information. Under that scenario, the user could review transaction A and approve it while the application generated a signature covering transaction B.
Ledger classified the issue as a time-of-check to time-of-use race condition. Its bulletin said the flaw defeated the trusted-display protection that hardware wallets use to let customers verify amounts, addresses and contract actions before signing. The issue did not reveal seed phrases or extract private keys from the secure element. This hardware wallet vulnerability follows other notable crypto security incidents, including the Coldcard hack that left 87% of stolen Bitcoin unmoved.
Exploitation Required a Compromised Connection
An attacker needed control of communications between the Ledger application and its host. Ledger listed malware, a compromised wallet application, or a hostile webpage with WebHID or WebUSB access as possible routes. The attack could not be performed remotely against an unplugged device. A user also had to approve the transaction while the malicious software manipulated its pending signing context. Ledger said the defect was located in the input and output handling of its Secure SDK, not the device operating system or firmware.
Ledger found no evidence that attackers exploited the vulnerability against customers. No cryptocurrency losses have been publicly linked to this specific issue. Users should open Ledger Live, install the latest device applications and verify the Ethereum app version on the hardware wallet. This security disclosure also connects to broader quantum-safe infrastructure efforts, including the first quantum-safe Bitcoin mainnet transaction by StarkWare.
Ledger Disputes Whether the Test Counts as a Hack
OneKey founder Yishi Wang said researchers completed the attack against Ethereum app 1.22.1 in a laboratory. Ledger Chief Technology Officer Charles Guillemet disputed that description, saying reproducing an already-patched bug is not hacking Ledger. The version history shows that Ethereum app 1.22.2, released Aug. 13, was the first application update containing state checks designed to stop the documented transaction substitution path. Ledger then released Secure SDK 26.6.1 on Aug. 21, which blocks interleaved commands before application code receives them. Ledger now recommends Ethereum app 1.22.3 or later.
