Ledger solucionó una vulnerabilidad en la aplicación de Ethereum

cryptonews.ruPublished on 2026-08-24Last updated on 2026-08-24

Abstract

La empresa Ledger ha solucionado una vulnerabilidad en su aplicación de Ethereum relacionada con ciertos flujos de firma transparente de transacciones. El Director Técnico, Charles Guillemet, anunció que el fallo, descubierto por su división interna Donjon utilizando herramientas de IA, podría haber permitido teóricamente a un contrato inteligente malicioso alterar los datos de una transacción durante la firma. Por ejemplo, un usuario podría creer que está aprobando una pequeña transferencia mientras en realidad autoriza acceso ilimitado a un atacante. La corrección ya está implementada en la versión 1.22.2 de la aplicación, y los usuarios con el firmware y las aplicaciones actualizadas están completamente protegidos. Guillemet criticó la divulgación pública de la vulnerabilidad por parte de una empresa externa de seguridad, calificándola de violación de los principios de divulgación responsable, ya que contactaron para una recompensa después del lanzamiento del parche y publicaron información que sugería que el problema persistía. Esta noticia surge tras la reciente revelación de Trezor sobre una filtración de datos de 13,689 usuarios debido a una brecha en su socio logístico.

La empresa Ledger ha corregido un fallo en algunos escenarios de firma transparente de transacciones en su aplicación de Ethereum. Así lo informó el Director de Tecnología de la compañía, Charles Guillemet.

Circula cierta desinformación (FUD) sobre los dispositivos Ledger, impulsada por una empresa de 'seguridad de contratos inteligentes' que afirma haber encontrado una vulnerabilidad en la aplicación de Ethereum de Ledger.

Hubo un error relacionado con ciertos flujos de firma transparente. Fue descubierto por el equipo @DonjonLedger utilizando sus herramientas de IA para la búsqueda de vulnerabilidades...

— Charles Guillemet (@P3b7_) 23 de agosto de 2026

El alto ejecutivo aclaró que el problema fue detectado por la división Donjon utilizando un conjunto de herramientas de IA para buscar vulnerabilidades. La solución ya se ha implementado en la versión 1.22.2.

Según Guillemet, los usuarios con los parches de firmware y aplicaciones actualizados están completamente protegidos.

La vulnerabilidad estaba relacionada con el procesamiento de flujos en los comandos APDU de la aplicación de Ethereum. En tal escenario, un contrato inteligente malicioso podría teóricamente suplantar los datos de una transacción en el momento de la firma.

Por ejemplo, un usuario podría pensar que está confirmando una pequeña transferencia, cuando en realidad estaba aprobando un acceso ilimitado para la dirección del atacante.

Guillemet criticó específicamente la divulgación pública del problema. Según él, una empresa externa solicitó una recompensa después del lanzamiento de la solución, no discutió el caso con el equipo del programa y luego publicó un hilo que podría dar la impresión de que el problema no estaba resuelto.

Así, un usuario de X bajo el seudónimo TestMachine describió detalladamente la mecánica potencial de suplantación de transacciones.

El CTO de Ledger calificó la situación como una 'violación de los principios de divulgación responsable de vulnerabilidades'.

Recordemos que el 13 de agosto, el fabricante de monederos de hardware Trezor informó de una fuga de datos personales de 13,689 usuarios. La causa fue un hackeo a su socio logístico ShipMonk.

end-content

Trending Cryptos

Related Questions

Q¿Qué vulnerabilidad corrigió Ledger en su aplicación de Ethereum?

ALedger corrigió un error relacionado con ciertos flujos de firma transparente de transacciones en la aplicación Ethereum. La vulnerabilidad permitía que un contrato inteligente malicioso pudiera, en teoría, falsificar los datos de la transacción durante la firma.

Q¿Cómo descubrió Ledger esta vulnerabilidad?

ALa vulnerabilidad fue descubierta por la unidad Donjon de Ledger, utilizando su conjunto de herramientas impulsadas por inteligencia artificial (IA) para la búsqueda de vulnerabilidades.

Q¿Cuál es la versión corregida de la aplicación Ethereum de Ledger?

ALa corrección ya está desplegada en la versión 1.22.2 de la aplicación Ethereum de Ledger.

QSegún el CTO de Ledger, Charles Guillemet, ¿qué hizo incorrectamente la empresa externa que divulgó el problema?

ACharles Guillemet criticó que la empresa externa solicitó una recompensa después de que Ledger ya hubiera lanzado la corrección, no discutió el caso con el equipo del programa y luego publicó un hilo que podría dar a entender que el problema no estaba resuelto, lo que calificó como una violación de los principios de divulgación responsable de vulnerabilidades.

Q¿Qué incidente relacionado con la seguridad de los usuarios menciona brevemente el artículo sobre Trezor?

AEl artículo menciona que el 13 de agosto, el fabricante de carteras de hardware Trezor informó sobre una fuga de datos personales de 13,689 usuarios, causada por una violación de seguridad en su socio logístico ShipMonk.

Related Reads

U.S. Aims at Iran's Crypto Sector Due to Oil Payments Exceeding $100 Billion

The U.S. Treasury Department has expanded sanctions on Iran to target its digital asset sector, citing over $100 million in cryptocurrency payments allegedly used to facilitate Iranian oil sales. The Treasury’s Office of Foreign Assets Control (OFAC) announced new sectoral sanctions covering digital assets, technology, gold, aviation, and shipping, alongside sanctions against nearly 60 entities, individuals, and vessels linked to nuclear, missile, cyber, and oil networks. The move allows OFAC to sanction foreign persons and firms operating in or supporting Iran’s crypto sector, which the Treasury stated is increasingly used as a "tool of choice" to circumvent sanctions, including by the Islamic Revolutionary Guard Corps (IRGC). Specific targets include Ukrainian broker Ivan Obukhov and his UAE-registered firm Foscom FZE, accused of processing over $100 million in crypto payments to facilitate oil sales for the IRGC’s Quds Force. This follows recent U.S. actions against Iran-linked crypto exchanges, including sanctions against UK-based Zedcex and Zedxion in January, four Iranian exchanges including Nobitex in June, and exchanges Shelbit and Aban Tether in August. Unlike previous targeted sanctions, the new measures establish a framework to penalize broader involvement in Iran’s crypto sector, significantly expanding OFAC’s authority under Executive Order 13902. Designated persons’ U.S.-linked property will be blocked, and foreign banks facilitating significant transactions for them may face U.S. account restrictions.

cryptonews.ru3m ago

U.S. Aims at Iran's Crypto Sector Due to Oil Payments Exceeding $100 Billion

cryptonews.ru3m ago

Conversation with Charles Zhang: Amidst the AI Frenzy, Why Pursue 'Anti-Efficiency' Content?

Dialogue with Charles Zhang: In the Era of AI's Sprint, Why Create "Anti-Efficiency" Content Standing out among China's early internet pioneers, Charles Zhang, founder and CEO of Sohu, maintains a distinct personal identity. He keeps a consistent public presence and embodies traits of high-energy individuals: sleeping only 4-5 hours daily, running 5km or marathons, and hosting frequent offline tech forums and dialogues with Nobel laureates. He has shifted focus from external business expansion to internal self-reconstruction, adhering to his own pace. "People aren't afraid of being busy; the busier you are, the better your health. Having nothing to do can lead to emotional issues and poor health." Marking the 10th anniversary of his live-streamed "Charles Zhang's English Class," he recently took it offline for a real-world classroom session. Following this, he discussed the course's decade-long journey, Sohu Video's content ecosystem, and the value of content in the AI era. **Pen and Mouth Diligence: A Class Against Instant Mastery** His English class began in August 2016 on "Qianfan Live." He spends about 40 minutes daily preparing, reviewing dozens of news headlines, reading five in detail, and selecting three for the lesson. Over ten years, he has completed over 2000 live sessions totaling more than 110,000 minutes, with over 52 million views. Initially, the stream was a way to "talk more" and combat emotional struggles. He started by repeating after TV news anchors, then moved to live-streaming with the launch of Qianfan Live. It was 40% for personal emotional regulation ("like a monk chanting sutras"), 30% to deliver authentic news, and 30% to promote the new platform. This daily "ritual" helped him overcome depression, leading to what he calls his "peak life state." From a product perspective, it was counter-intuitive—launched without prior market research or growth strategies, based on the founder's personal need that resonated with users. Yet, his content creation follows a strict routine. The decade of covering geopolitics, economics, tech, health, and society has built a vast "knowledge compound interest" system. In an age of AI summaries and algorithmic content, Zhang insists on "hard work": meticulous reading, handwritten notes, and manually created teaching materials, refusing AI-generated content. The English class is now a fixed daily rhythm; preparing for his weekly physics class requires a full day of solitary deduction on a blackboard. In his live streams, Zhang positions himself as a "content creator," not a CEO or teacher. He sees physics as extreme brain training and English as a "sensor" to understand the world. This explains why a top entrepreneur persists for a decade in seemingly "unprofessional" pursuits—it's the information input and psychological healing method he found during a low point. It's fundamentally an "anti-efficiency" commitment. He believes the meaning of reading lies in finding community and spiritual support, not just fleeting conversation points. For today's media, he states: "Reading news isn't the goal. As humans with many confusions, we need reference points, to find a group, find kindred spirits, or seek support and spiritual nourishment. Large language models can't satisfy these starting points; they only give you information." This offers solace and a value defense for media professionals impacted by AI summaries. **"Don't Think Earth Stops Turning Because AI Arrived"** A content creator expressed anxiety: after feeding their article to AI, it produced a more comprehensive, profound version, making their work feel valueless. Zhang responded with an analogy: "Carrots from the market, with a bit of soil, not glossy, taste delicious and flavorful. Tomatoes forced by chemical fertilizer have no taste at all." He sees AI giving world content a "plastic feel," but acknowledges its significant role in improving information access efficiency, especially in physics and social science research where he often queries AI for quick professional answers. The key, Zhang stresses, is that the outside world still needs to guide our perspective. LLMs provide "information," while the outside world offers "viewpoints." He cares deeply about *what* that external viewpoint is and *how* someone thinks about an issue. "Don't think the Earth stops turning because AI arrived," he analyzes. AI currently replaces rule-based work, noting significant impact on the software industry with many programmers laid off as even less experienced people can now write decent code. However, AI cannot yet replace arts, social sciences, emotions, and creative content. "Hollywood remains thriving, producing great works. Oscars will continue, Nobel Literature Prizes will still be awarded—all by real people, with works conceived by real people." While wary of AI, Zhang isn't anti-technology and is open to its applications. Sohu itself has launched AI assistants. In Sohu's AI practice, Zhang defines his role as a "large language model corpus provider." He believes LLM training is inseparable from human-original content as its data foundation, so original content retains irreplaceable value. "The era of self-media indeed offers everyone new ways to discover their strengths and achieve growth." He suggests every young person should consider self-media. Most importantly, the bottom line of content creation should be "authenticity." If using AI avatars, they must be clearly labeled; not doing so and misleading viewers wastes their time, especially when people still prefer real human content. Behind AI's sprint lie unavoidable realities. As AI quickly provides seemingly perfect answers, people grow accustomed to accepting "summarized" results, omitting processes of questioning, deduction, and trial-and-error, leading to a decline in deep thinking. Zhang's "anti-efficiency" practice with his two live-streamed classes is his answer to AI's狂奔: In an algorithm-driven era chasing ultimate efficiency, don't expect AI to fill inner voids. Read books, speak in front of a camera, sweat on a running track, and build connections with real people.

marsbit13m ago

Conversation with Charles Zhang: Amidst the AI Frenzy, Why Pursue 'Anti-Efficiency' Content?

marsbit13m ago

Zcash's ETF Gilding: How a Privacy Coin Was Packaged by Wall Street into a Compliant Asset

The article traces the decade-long path of Zcash (ZEC), a privacy-focused cryptocurrency, to its potential launch as the first privacy coin spot ETF, with Grayscale's ZCSH filing in August 2026. It argues ZEC's suitability stemmed not from regulatory acceptance of its privacy technology, but from its centralized, institutional structure from inception—a commercial company (ECC) with venture capital backing and a Founder's Reward—making it easier to package than decentralized alternatives. Three key institutions, intertwined in a network, drove the process: Grayscale (owned by DCG, an early ZEC investor), which had held ZEC in a trust since 2017; Coinbase, providing custody, prime brokerage, derivatives, and venture investment; and ZODL, a new for-profit entity formed in 2026 when ECC's core development team split from the non-profit foundation. The major regulatory hurdle was SEC scrutiny (2023-2026) over ZEC's historical structure, which resembled an unregistered investment contract due to automatic block rewards to ECC and the Foundation. This was resolved through governance changes (NU6 upgrade in 2024) that ended direct funding and shifted control to community voting, coinciding with a broader shift in SEC enforcement policy. Notably, the law firm Davis Polk represented both the Zcash Foundation in its SEC defense and Grayscale in the ETF filing. The push is also driven by DCG's dire financial needs amid Genesis bankruptcy lawsuits, seeking high-fee products (the ZEC ETF charges 2.5%). Concurrently, major mining operations by entities like Cypherpunk Technologies (backed by Winklevoss Capital) and DCG's Fortitude Mining expanded, motivated by profitability and aiming to influence the network. The article concludes with irony: to become a compliant ETF asset, ZEC must shed its core privacy feature for the fund's holdings, which will be held in transparent, auditable addresses. Wall Street is not adopting privacy technology but packaging the *concept* of privacy into a tradable, fee-generating financial product. The transformation was not a single master plan but the result of a network of aligned interests capitalizing on regulatory, governance, and market shifts over ten years.

marsbit23m ago

Zcash's ETF Gilding: How a Privacy Coin Was Packaged by Wall Street into a Compliant Asset

marsbit23m ago

Bitcoin Core Developer Warns That Bitcoin Payments Are Disappearing at 'Bitcoin Beach'

A Bitcoin Core developer, John Atack, who has lived in El Salvador since 2022, shared a concerning anecdote about Bitcoin adoption in the country. While dining at El Zonte, a region known as "Bitcoin Beach," he paid with Bitcoin and was told it was the first such payment the establishment had received in a month. Staff explained Bitcoin payments, once common, have now virtually disappeared, with nearly all customers using cards. An employee even declined a Bitcoin tip, stating she had forgotten how to use her wallet and declaring "It's already dead." Atack emphasized this was a single observation but noted the employee had witnessed the payment evolution over three years. His comments sparked mixed reactions. Some disputed his experience, with one user confirming successful Bitcoin payments in the same area. However, Bitcoin reporter Juan Galt acknowledged an underlying "economic problem," arguing that expecting price appreciation makes using Bitcoin for everyday transactions counterintuitive to economic incentives needed for a circular crypto economy. Despite the concerning report, Atack also reflected that El Salvador remains a global leader in cryptocurrency adoption and progressive legislation, sometimes causing locals to take these advancements for granted. The story highlights the ongoing challenges of mainstream Bitcoin adoption for daily commerce, even in pioneering nations.

cryptonews.ru26m ago

Bitcoin Core Developer Warns That Bitcoin Payments Are Disappearing at 'Bitcoin Beach'

cryptonews.ru26m ago

Trading

Spot

Hot Articles

Discussions

Welcome to the HTX Community. Here, you can stay informed about the latest platform developments and gain access to professional market insights. Users' opinions on the price of ETH (ETH) are presented below.

活动图片