On August 27, 2026, Yishi Wang, founder of OneKey — a hardware wallet manufacturer and developer of the OneKey App — stated on social media platform X that the OneKey Anzen team was able to conduct a transaction substitution attack on Ledger's Ethereum application version 1.22.1 under laboratory conditions. Ledger's subsidiary, Donjon, responded on the same platform on August 27, 2026, stating that no hardware wallet users were affected and that the described incident was a laboratory demonstration of an already patched vulnerability.
According to Wang, the discovered issue represents a race condition between the logic for displaying the transaction on the device screen and the transaction buffer itself. An attacker gains the ability to overwrite a transaction awaiting signature at the moment the user is viewing a legitimate operation on the display. As a result, transaction A is shown on the screen, the user confirms it, but the device actually signs a completely different transaction B, which the user did not see. To verify the attack, the OneKey team independently compiled the ELF file for version 1.22.1. Wang noted that Ledger patched the vulnerability in application version 1.22.3 and recommended that owners of older versions update.
In the community comments under his post, it was clarified that the discovered bug matches a vulnerability publicly disclosed by researcher TestMachine on August 22, 2026, and that Ledger had already fixed it in version 1.22.2, not 1.22.3.
What TestMachine Said
Researcher TestMachine reported on August 22, 2026, that the vulnerability was discovered by the offline scanning tool Azimuth while checking Ledger's Ethereum application. The bug was confirmed on the Flex device, and the affected code was the common APDU command processing and interface code also used on Nano X, Nano S Plus, Stax, and Apex models. At the time of publication, the patched version 1.22.2 had not yet been released. Two days later, on August 24, TestMachine noted the release of version 1.22.2 on GitHub with the note "Security issues" and advised updating the application via Ledger Live.
Ledger Donjon's Position
According to Donjon's statement, no cases of real-user compromise were recorded. The issue was discovered as part of an internal security process and was fixed in version 1.22.2, released on August 13, 2026, i.e., before OneKey's post. The company found no evidence of exploitation in the wild. Users are recommended to update applications to the latest version, and the Ethereum application to at least version 1.22.3, via Ledger Wallet, while separately verifying the application version on the device itself.
Official Bulletin LSB 023
The official Ledger security bulletin published on August 27, 2026, numbered LSB 023, describes the vulnerability class: while the user was viewing an operation on the screen, the host device could send a new APDU command over a previous, unprocessed one, allowing the signature parameters to be altered after they were shown to the user but before the actual signing occurred. The defect resides in the input/output handling of the Ledger Secure SDK, not in the device's operating system or firmware.
The fix was released in two stages:
- at the individual application level — the first update was the Ethereum version 1.22.2, released on August 13, 2026;
- at the SDK level itself — version v26.6.1 was released on August 21, 2026, after which applications were rebuilt using the updated framework.
The company emphasizes that updating only the firmware is insufficient — users need to update the applications specifically through Ledger Live. Ledger reiterates that no evidence of the vulnerability being exploited against users has been found.
GitHub Release Timeline
The LedgerHQ/app-ethereum repository on GitHub indicates that release 1.22.2 is dated August 24, 2026, with the note "Security issues," and release 1.22.3 is dated August 26, 2026, including a number of additional fixes related to the clear-signing mechanism and other transaction processing paths.
The discrepancy in assessments between OneKey and Ledger Donjon boils down to the version in which the bug was patched: 1.22.2 versus 1.22.3. Both sides agree that users should update their Ethereum application to the current version via Ledger Live.
AI Opinion
From the perspective of machine data analysis, the debate over version 1.22.2 versus 1.22.3 is less important than the class of the discovered bug itself — a race condition between on-screen display and the actual transaction signing. Such logic is vulnerable not only in Ledger applications: a similar problem in the chain of trust has manifested in other hardware wallets, where a defect at the random number generator level in the Coldcard wallet led to predictable keys and losses amounting to hundreds of millions of dollars. The situation demonstrates a general principle: the security of a hardware wallet depends not on a single link — firmware, SDK, or application — but on the entire chain of components simultaneously, and a breach in any one of them devalues the other protections.
A technical nuance that remained outside the discussion: separate update cycles for applications and the SDK, as in the case of the Ethereum application and the Ledger Secure SDK, create a window where part of the ecosystem is already protected and another part is not yet. What happens if such windows start to be discovered faster than manufacturers can close them?
end-content
