Hardware wallet maker OneKey says its security researchers successfully reproduced a transaction-replacement attack against Ledger, demonstrating a vulnerability that could cause a device to sign a different Ethereum transaction from the one displayed to its owner.
OneKey founder and CEO Yishi Wang disclosed the laboratory test on August 27, saying the company’s Anzen security team successfully reproduced the attack against Ledger Ethereum app version 1.22.1.
“We hacked Ledger,” Wang wrote while describing the test. Ledger disputes that characterization.
The French hardware-wallet manufacturer confirmed the underlying vulnerability but said OneKey tested an outdated application after protections against the attack had already been released.
“No Ledger user was hacked,” Ledger Chief Technology Officer Charles Guillemet responded. He characterized OneKey’s demonstration as the reproduction of an already-patched bug rather than a new compromise of Ledger.
Ledger says it has found no evidence that the vulnerability was exploited against customers or resulted in cryptocurrency losses.
Vulnerability Could Replace Transaction During User Review
The issue involved a race condition between Ledger’s transaction-display process and the underlying buffer containing the transaction waiting to be signed. Hardware wallets are designed around a trusted-display principle: transaction details shown on the hardware device itself should represent exactly what the secure device will ultimately sign.
The vulnerability could break that guarantee. An attacker controlling communications between a Ledger device and its host could initially present a legitimate transaction while the user reviewed it on the hardware wallet.
Before the user approved it, the attacker could send another command that replaced transaction parameters stored in memory without changing what remained visible on the device. The user could therefore review transaction A and approve it while the Ledger application actually generated a signature for transaction B.
That could theoretically allow funds to be redirected to an attacker-controlled address even though the malicious destination was never displayed on the hardware wallet. The vulnerability did not expose recovery phrases or extract private keys from Ledger’s Secure Element.
Exploitation also required the attacker to already control communications with the device, potentially through malware, a compromised wallet application or a malicious website using WebHID or WebUSB. It was therefore not an attack that could remotely drain an untouched Ledger simply because it was vulnerable.
Ledger Says Fix Arrived Before OneKey Disclosure
OneKey said Ledger Ethereum app version 1.22.3 fixes the issue and advised users running older versions to update.
Ledger provided a more detailed timeline. According to the company, Ethereum app version 1.22.2, released August 13, introduced application-level protections against the transaction-replacement attack.
Ledger then released Secure SDK version 26.6.1 on August 21, addressing the underlying problem by preventing interleaved commands from reaching applications while users were reviewing transactions. Applications were subsequently rebuilt using the corrected SDK.
Ledger now recommends that users run Ethereum app version 1.22.3 or later because the newer release incorporates broader protections and also fixes a separate transaction-display vulnerability.
The disagreement therefore concerns less whether the security weakness existed than how OneKey characterized its demonstration.
Ledger CTO Guillemet said reproducing an already-fixed vulnerability against an old application version does not constitute “hacking Ledger,” noting that the company had identified and patched the problem before OneKey’s August 27 disclosure.
The episode nevertheless highlights the importance of software updates even for hardware wallets. Hardware wallets isolate private keys from internet-connected computers, but transaction signing still depends on firmware, individual blockchain applications and communications with potentially untrusted host devices.
Ledger’s ability to patch the issue remotely across devices is also central to its security architecture. Its internal Donjon security team argued following the disclosure that updateability is necessary precisely because vulnerabilities can emerge after hardware enters circulation.
For Ledger users, the immediate recommendation is straightforward: update device applications independently of firmware and ensure the Ethereum app is version 1.22.3 or later.
For the wider hardware-wallet industry, the demonstration underscores a subtler security problem. Protecting private keys is not sufficient if compromised software can manipulate what those keys are instructed to sign.
In this case, researchers demonstrated that an outdated Ledger application could violate one of hardware wallets’ most important promises — that the transaction displayed on the trusted screen is the transaction the device actually signs.