Ledger Denies Hack Claims as Patched Ethereum App Vulnerability Comes to Light
TL;DR:
- The vulnerability affected version 1.22.1 of the Ethereum app for Ledger and allowed a race condition that replaced transactions before signing.
- The manufacturer patched the initial flaw on August 13, 2026, in version 1.22.2 and strengthened the system with Secure SDK 26.6.1 on August 21, 2026.
- The company published its official security bulletin on August 27, 2026, confirming the absence of active exploits in real-world environments.
Ledger denies hacking allegations after demonstrations of a technical flaw in outdated versions of its Ethereum application were published, clarifying—on Thursday, August 27—that the security patch was deployed prior to its public disclosure.
No Ledger user was hacked.
What's described here is a lab reproduction of a vulnerability in an outdated version of the Ethereum app.
The issue was already identified through our security process and fixed in Ethereum app 1.22.2, released August 13, before this post. The…
- Ledger (@Ledger) August 27, 2026
The controversy began when security researchers from rival firm OneKey posted on social media that they had managed to recreate an attack in a lab setting. Regarding this, OneKey CEO Yishi Wang stated that the weakness stemmed from a race condition between the data buffer and the physical device’s visual interface.
… Continue reading the full article at the original source below.
