Ledger CTO Charles Guillemet said a vulnerability in certain clear-signing flows in the Ledger Ethereum app was discovered by Ledger Donjon and fixed two weeks ago.

Users who keep their Ledger firmware and apps up to date are protected. Guillemet also said a self-described “smart contract security” firm disclosed the issue only after the fix was deployed and later implied that it remained unresolved.