Ledger disputes OneKey hack claim over patched Ethereum app flaw

The dispute centers on a time-of-check to time-of-use race condition that allowed for transaction substitution. By exploiting a weakness in how the device handled Application Protocol Data Unit (APDU) commands, an attacker could theoretically overwrite signing parameters while a user reviewed a transaction on the device screen. This flaw bypassed the hardware wallet's trusted-display guarantee, potentially causing a user to approve a different transaction than the one shown.

Ledger Chief Technology Officer Charles Guillemet characterized the OneKey demonstration as a laboratory exercise against legacy software rather than a breach of the company’s security infrastructure. Records indicate that Ledger released Ethereum app version 1.22.2 on August 13, which introduced state checks to block the substitution path, followed by a Secure SDK update on August 21 that prevented interleaved commands entirely. Ledger confirmed no evidence exists that this vulnerability was ever leveraged to cause user losses or unauthorized asset transfers.

To mitigate risks, Ledger advises users to manage their device security through the Ledger Live interface. Because the flaw resided within application-specific logic rather than the core firmware, users must manually update their Ethereum applications to version 1.22.3 or later. The company also noted that third-party developers using the affected SDK versions—released between August 2025 and August 2026—must rebuild their applications to incorporate the necessary security patches.