Ledger says the viral “hack” was already patched, but two real bugs still needed fixing

Crypto wallet maker Ledger is urging its Ethereum app users to update again after two signing flaws remained in its previous security release.

The hardware-wallet maker published Ethereum app version 1.22.3 on Aug. 25, closing vulnerabilities that could hide operations from a device review or authorize a token approval in place of an expected payment.

The update follows controversy over a separate Ethereum signing flaw reproduced by rival wallet maker OneKey. That issue, tracked as LSB-023, affected older versions and allowed a compromised host to interleave commands so that transaction parameters could change after being displayed but before signing.

Ledger said OneKey demonstrated the bug against version 1.22.1 after the company had already fixed it in Ethereum app 1.22.2, released Aug. 13.

“No Ledger user was hacked,” Ledger’s security team said, describing the demonstration as a laboratory reproduction involving outdated software. The company said it had found no evidence of exploitation in the wild.

Ledger Chief Technology Officer Charles Guillemet made the same distinction, saying reproducing an already-patched flaw did not amount to “hacking Ledger.”

Version 1.22.2, however, did not close every known Ethereum-app vulnerability on Ledger. Instead, two separate flaws, LSB-024 and LSB-025, remained until the release of 1.22.3.

Two additional signing paths remained exposed

LSB-024 affected how the Ethereum app processed arrays of operations during clear signing.

The app read the number of operations using a 16-bit value but stored the remaining count in an 8-bit field. In Ledger’s proof of concept, an array containing 257 operations wrapped the counter back to one, causing the device to display only the final operation even though its signature authorized the entire batch.

Exploitation required a compromised host and an unusually large attacker-controlled operation array. Ledger tested the scenario on a private network fork and reported no real-user losses.

The second vulnerability, LSB-025, affected the token-payment path used by Ledger’s Exchange application during swaps.

Ledger’s app checked the token, quantity, and destination but did not verify that the requested action was actually a payment. A malicious or compromised swap provider could therefore substitute a token approval matching those same parameters and have it signed without an additional device prompt.

The flaw could not create an unlimited approval, switch to another token, or grant permission to an arbitrary address. An approval also does not itself transfer funds, requiring a subsequent transaction before the approved assets could move.

Ledger said it found no evidence that the swap vulnerability was exploited.

The release history raises a separate question. Ledger’s records show the fix for the array-count issue was merged on May 5 and the swap-validation correction on May 25, months before version 1.22.2 was released. Its security bulletins do not explain why those changes were absent from that update.

Ledger defended its broader approach by pointing to updateability as central to hardware wallet security. Its security team said it continuously identifies vulnerabilities through internal research and external bug-bounty programs, then patches them through software releases.

For users, the distinction between the three vulnerabilities is important. Version 1.22.2 fixed the command-interleaving flaw later reproduced by OneKey, while version 1.22.3 is required to address the two additional signing bugs disclosed Aug. 27.

Ledger recommends installing Ethereum app 1.22.3 or later through Ledger Live and verifying the version on the device. Updating the hardware wallet firmware alone does not replace the affected Ethereum application.