The internal security researchers at open-source crypto wallet provider OneKey have successfully replicated a significant exploit targeting a previous version of Ledger’s Ethereum application. Their investigation confirmed that a now-patched security flaw in Ledger Ethereum app version 1.22.1 allowed for potential manipulation of transaction signing.
Details of the Experiment
Yishi Wang, CEO and founder of OneKey, reported that the team carried out a “transaction replacement attack” on the deprecated version of the Ledger Ethereum app in a controlled environment. By leveraging a previously fixed vulnerability, researchers were able to overwrite a legitimate transaction with a malicious one during the user’s review phase prior to completing the signature process.
Ledger, a France-based hardware wallet manufacturer known for providing secure offline storage for crypto assets, confirmed that the vulnerability required an attacker to control the communication between the wallet device and its connected host. This could potentially occur if the host computer were infected with malware, compromised wallet software, or a malicious website was accessed during the signing process.
OneKey security researchers demonstrated that a patched flaw in the old Ledger Ethereum app could be exploited to switch transactions before they were confirmed by the user, but the attack was only possible under specific, compromised conditions.
Ledger implemented application-level protections to address the risk with the release of Ethereum app version 1.22.2 on August 13. The company completely remediated the root cause in Secure SDK version 26.6.1, available as of August 21. Ledger has emphasized that, in this instance, no user funds were lost or compromised due to the vulnerability, since the test took place solely within a laboratory context and relied on a now outdated app version.
ETH
SOL
BSC
ROBINHOOD
USDT
AAPLColdcard Exploit and Ledger’s Response
The incident involving OneKey’s security assessment recalls a separate exploit targeting Coldcard wallets in July. In that event, a firmware bug introduced in March 2021 undermined the randomness used in creating mnemonic seed phrases, making some Coldcard wallets susceptible to brute-force attacks seeking to uncover private keys.
Ledger clarified that its hardware wallet devices, including its security chips, were not vulnerable to the specific Coldcard flaw. Ledger hardware uses a certified source of randomness to generate wallet recovery phrases, ensuring higher resistance to such attacks.
The exploit reproduced by OneKey is unrelated to seed phrase generation or entropy. Instead, it directly concerns transaction handling within the device during the signature process.
Mini dictionary: OneKey is an open-source cryptocurrency wallet provider offering both hardware and software solutions focused on user control and transparency. Coldcard is a hardware wallet specialized for Bitcoin, emphasizing minimal connectivity and advanced security features for offline storage.
Ledger’s Assurance
Ledger addressed the test results in a post on X, stating that no users were impacted, and affirmed the exploit only affects now-obsolete software.
“No Ledger user was hacked. What’s described here is a lab reproduction of a vulnerability in an outdated version of the Ethereum app,” Ledger announced.
Recent security assessments have highlighted the ongoing importance of prompt firmware and software updates on hardware wallets, particularly given the evolving threat landscape in the digital asset sector.
