According to latest reports, OneKey's Anzen security team has successfully reproduced the patched Ethereum vulnerability against an outdated application version. OneKey founder Yishi Wang announced on August 27 that researchers completed the transaction replacement attack against Ledger Ethereum app version 1.22.1 in laboratory testing. However, Ledger Chief Technology Officer Charles Guillemet has rejected the characterization of this as a hack, stating "reproducing an already-patched bug is not 'hacking Ledger'" and describing OneKey's work as a laboratory exercise against an older application. The controversy centers on whether the reproduction of a previously fixed vulnerability constitutes a legitimate security demonstration.
According to reports from Ledger, the company fixed a vulnerability affecting certain clear signing flows in its Ethereum application before another security company disclosed the issue publicly. Chief Technology Officer Charles Guillemet announced on August 24, 2026 that Ledger Donjon, the company's internal security research team, discovered the bug using an artificial intelligence vulnerability research system. Ledger deployed the fix on August 12, 2026, with users now protected by updated firmware and applications. The disclosure came after the fix shipped, following the standard order for hardware wallet vendors that want a patch in users' hands before attackers learn the details. However, the patch existed in the wild for approximately ten days without public awareness before security researcher TestMachine forced the conversation through public disclosure between August 21-23, 2026.
The security flaw involved an Application Protocol Data Unit (APDU) command race condition between connected applications and Ledger's Ethereum app, potentially allowing an attacker to replace expected transactions with competing actions. During what Ledger calls 'clear signing' flows, where the device displays human-readable transaction details on its screen, the race condition could have allowed a second, malicious APDU command to slip in and replace the original transaction data. According to TestMachine, this could enable a device to display one transaction while preparing another for signing, with researchers describing possible scenarios like replacing limited transactions with broader token approvals. The attack would have required a compromised or malicious dApp to exploit the timing window, with users interacting with trusted, legitimate applications remaining at no risk. Guillemet framed the issue as limited to 'certain signing flows' in the Ethereum app rather than a wallet-wide compromise, pointing to a specific code path rather than a device secure element or seed phrase compromise.
As reported by Ledger, no independently verified reports of funds stolen through this specific vulnerability had emerged by August 24, 2026. The company found no evidence the vulnerability was exploited against users or caused cryptocurrency losses anywhere. An attacker needed control of communications between the Ledger application and its host, with possible routes including malware, a compromised wallet application, or a hostile webpage with WebHID or WebUSB access. The attack could not be performed remotely against an unplugged device, and a user had to approve the transaction while the malicious software manipulated its pending signing context. The defect was located in the input and output handling of Ledger's Secure SDK, with the company saying the weakness was introduced in August 2025 and affected SDK versions through 26.6.0. The issue did not reveal seed phrases or extract private keys from the secure element, instead causing the protected key to sign parameters different from those shown to the user.
According to Ledger, Ethereum app version 1.22.2 was the first application update containing state checks designed to stop the documented transaction substitution path, released on August 13. The company then released Secure SDK 26.6.1 on August 21, which blocks interleaved commands before application code receives them. Ledger now recommends Ethereum app 1.22.3 or later because the newer release contains broader SDK protection and addresses another transaction-display flaw. Users should open Ledger Live, install the latest device applications and verify the Ethereum app version on the hardware wallet, as updating firmware alone does not replace applications built with an affected SDK. Third-party developers must also review their state handling and rebuild applications with Secure SDK 26.6.1 or later, with Ledger confirming that applications compiled with the corrected SDK are protected against the vulnerability.
