Headline: Ledger rebuffs “hack” claims after OneKey reproduces transaction-replacement bug in old Ethereum app Ledger has pushed back after OneKey’s Anzen security team said it had “hacked Ledger” by reproducing a transaction-replacement flaw against an outdated Ethereum application. Ledger says the vulnerability was real but had already been fixed before OneKey’s public demonstration. What happened - On Aug. 27 OneKey founder Yishi Wang tweeted that his team had successfully reproduced a transaction-replacement attack against Ledger’s Ethereum app version 1.22.1 in a lab environment. He described the issue as a race condition between the transaction display and the underlying transaction buffer. - Ledger acknowledged the underlying vulnerability but emphasized the company had patched the flaw before OneKey published the demo. Ledger’s CTO Charles Guillemet said “reproducing an already‑patched bug is not ‘hacking Ledger,’” calling OneKey’s work a laboratory exercise against an older app. How the bug worked (in plain terms) - Ledger apps receive instructions called APDUs (Application Protocol Data Unit commands) from wallet software, webpages or other host interfaces. - In affected app builds, a second APDU could be accepted while the user was still reviewing a transaction on the device screen. That second command could overwrite signing parameters in shared memory without changing what the device displayed. - The result: a user might review and approve transaction A on the device, while the secure key actually signed transaction B — and the device would not warn the user that the underlying signing data had changed. - Ledger classified this as a time-of-check to time-of-use (TOCTOU) race condition that defeated the trusted-display protections hardware wallets rely on to let users verify amounts, addresses and contract actions. What was and wasn’t at risk - The flaw did not leak seed phrases or extract private keys from the secure element. Instead, it could cause a protected key to sign inputs different from those shown to the user. - An attacker required control of the communication channel between the Ledger app and its host — e.g., malware on the host, a compromised wallet app, or a hostile webpage with WebHID/WebUSB access. The attack could not be executed remotely against an unplugged device. - A successful exploit also needed the user to approve a transaction while the malicious software manipulated the pending signing context. Where the bug lived and how it was fixed - Ledger says the defect was in input/output handling in its Secure SDK, not in device operating system or firmware. Apps built with affected SDK releases relied on their own state checks to reject interleaved commands. - Because of that, exposure was application-specific: an app remained safe if every asynchronous command entry point correctly checked state, even when built with the affected SDK. - Timeline of fixes: - Aug. 13: Ethereum app 1.22.2 added application-level state checks that stop the documented transaction-substitution path. - Aug. 21: Ledger released Secure SDK 26.6.1, which blocks interleaved commands before application code receives them. Apps were subsequently rebuilt with the corrected SDK. - Ledger now recommends Ethereum app 1.22.3 or later because it includes the broader SDK protection and fixes an additional transaction-display flaw. OneKey was correct that 1.22.3 is protected, but the first application-level mitigation arrived in 1.22.2. Practical guidance for users and developers - Ledger reports no evidence that attackers exploited the issue (identified as LSB-023) and no crypto losses have been publicly linked to this specific vulnerability. - Users should open Ledger Live, install the latest device applications and verify the Ethereum app version on their hardware wallet. Installing a firmware update alone does not replace applications that were built with an affected SDK — apps must be updated too. - Third-party app developers should review their state handling and rebuild applications with Secure SDK 26.6.1 or later. Ledger says the weakness was introduced in August 2025 and affected SDK versions up through 26.6.0. Broader context - The disclosure follows a spate of hardware wallet fixes; for example, BitBox recently patched two vulnerabilities affecting firmware installation and Bitcoin address handling, also without evidence of confirmed exploitation. Bottom line The technical issue OneKey demonstrated was real but limited in scope: it required a compromised host and user approval, and Ledger says it fixed the problem before the demo was public. Users should update apps via Ledger Live and developers must rebuild with the patched SDK to close the window of exposure. Read more AI-generated news on: undefined/news