Ledger, a prominent cryptocurrency wallet manufacturer, has refuted claims of a hacking incident following an experiment by OneKey, a rival wallet developer. OneKey's Anzen security team demonstrated a transaction-replacement vulnerability in Ledger’s outdated Ethereum application version 1.22.1.
Yishi Wang, founder and CEO of OneKey, revealed on X that they successfully replicated the vulnerability in a controlled setting. He explained that the flaw arises from a race condition between transaction display logic and the underlying transaction buffer, which could allow an attacker to overwrite a legitimate transaction before the user signs it.
In response, Ledger’s Chief Technology Officer, Charles Guillemet, clarified that replicating a previously patched vulnerability does not imply an actual hack. He emphasized that the vulnerability was addressed in version 1.22.2, released on August 13, prior to OneKey's announcement. Guillemet stated, "No user was hacked. No exploitation in the wild."
Ledger's security bulletin indicated that for the vulnerability to be exploited, an attacker would need to gain control of the communication between the device and its host through malware or other means. The company confirmed that there is no evidence of this vulnerability being exploited in real-world scenarios.
Ledger has since implemented additional security measures, urging users to update to Ethereum app version 1.22.3 or higher, which also addresses another related issue. The company highlighted the importance of keeping wallet software updated, noting that all software can have bugs and that updateability is a fundamental aspect of their security framework.
In a recent comment to Decrypt, Guillemet referenced a significant theft of over $130 million in Bitcoin from Coldcard wallets as a reminder of the need for vigilance in the hardware wallet industry. He reiterated the role of Ledger's internal security team, Ledger Donjon, in identifying and addressing vulnerabilities proactively.
