AnswersPublished19 sources
Ledger’s Ethereum App Bugs Explained: OneKey Reproduction, Fixes and What Users Should Do
Ledger’s August 2026 disclosures covered three Ethereum app flaws, not a reported private key or firmware compromise; the company says it found no evidence of user exploitation. OneKey reproduced LSB 023 against outdated app version 1.22.1 in a controlled lab.
Published byEdited with GPT-5.6 LunaImages generated with GPT Image 1.5
Research answer
Key takeaways
- Ledger’s August 2026 disclosures covered three Ethereum app flaws, not a reported private key or firmware compromise; the company says it found no evidence of user exploitation.
- OneKey reproduced LSB 023 against outdated app version 1.22.1 in a controlled lab.
- LSB 024 could hide operations in a 257 item clear signing batch, while LSB 025 could substitute a token approval for a swap payment under narrow conditions.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What happened with Ledger’s Ethereum app security vulnerabilities in August 2026—including OneKey’s controlled reproduction of the already-p. Article summary: In August 2026, Ledger disclosed three Ethereum-app issues affecting the reliability of its trusted display—not a compromise of users’ private keys or Ledger’s operating system. Ledger said it had no evidence that any us. Topic tags: general, documentation, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks,
Ledger’s August 2026 security episode involved three vulnerabilities in the Ethereum application used on Ledger devices. The issues affected how transactions and swap operations were parsed, displayed, or approved—not the extraction of users’ private keys or a reported compromise of Ledger’s operating system. Ledger says it found no evidence that users were hacked or that the flaws were exploited in the wild. 35
38
The immediate practical advice is straightforward: update the Ethereum app through Ledger Live to version 1.22.3 or later, then open the app on the device and confirm its installed version. 35
What OneKey reproduced
OneKey’s Anzen security team reproduced LSB-023, a transaction-replacement race condition, against Ethereum app version 1.22.1 in a controlled laboratory test. The flaw involved the device accepting a new APDU command while an earlier command was still waiting for the user’s response. Because transaction data remained in shared state during the on-screen review, the parameters displayed to the user could differ from the parameters ultimately signed. 2
In practical terms, an attacker controlling the communication path between a host computer and the Ledger could attempt to replace a pending transaction after the legitimate transaction had appeared on the device. The scenario required a compromised host environment—such as malicious software or wallet code with device access—and still required the user to approve the prompt shown on the Ledger. It was not a seed-extraction attack. 21
27
Ledger disputed the description of the incident as a new live hack. The company said the issue had already been fixed in Ethereum app version 1.22.2, released on August 13, before OneKey’s public demonstration. Ledger also identified a broader mitigation in Secure SDK version 26.6.1. 22
35
The two additional Ethereum-app flaws
LSB-024: a 257-operation batch could be displayed incompletely
LSB-024 affected the Ethereum app’s handling of arrays during clear signing. The parser read an operation count as a 16-bit value but stored the remaining count in an 8-bit field. With a batch of 257 operations, the count could wrap so that the device displayed only the final operation even though the signature covered the full batch. 37
This was not a general-purpose attack against every Ethereum transaction. The described conditions included a compromised host, a clear-signing descriptor that iterated over attacker-controlled data, and a contract capable of accepting and executing a batch larger than 255 operations. Ledger fixed the issue in Ethereum app version 1.22.3. 37
LSB-025: a swap payment could become a token approval
LSB-025 affected a specific swap flow involving the Exchange application. The Ethereum app checked the destination address and quantity expected for the swap, but did not verify that the operation was actually a token transfer rather than an ERC-20 approval. A malicious or compromised swap provider could therefore submit an approval that matched the expected asset, amount, and provider address and have it signed without a second device prompt. 34
The limitation matters. The approval was tied to the already-validated swap-provider address and expected quantity rather than an arbitrary attacker address or unlimited allowance. A separate later transaction would still be needed to move the approved tokens, and the expected swap payment would not arrive, causing the swap to fail rather than complete normally. The issue did not affect ordinary, non-swap approval flows. Ledger fixed LSB-025 in version 1.22.3. 34
What the episode says about hardware-wallet security
A hardware wallet can isolate private keys while still containing application-level weaknesses in transaction parsing, display logic, or the handoff between connected software and the device. These Ledger cases centered on whether the device reliably showed and validated the operation that it signed.
That distinction explains why updateability matters. The secure element and key isolation remain important protections, but they do not eliminate bugs in individual blockchain applications. Ledger’s response emphasized application updates, SDK hardening, ongoing security review, and vulnerability research as part of the security model. 27
38
The unresolved release-timing question
The disclosures also raise a release-management issue: the supplied security-bulletin record identifies fixes for LSB-024 and LSB-025 separately from the later version 1.22.3 release, but the published material provided here does not explain the interval between the fixes being prepared and becoming available to users. 5
34
37
That timing question is separate from the exploitability of the bugs. It does not establish that users were compromised, but it is relevant to how quickly security fixes reach hardware-wallet customers.
What Ledger users should do now
- Open Ledger Live and update the Ethereum app to version 1.22.3 or later.
- Open the Ethereum app on the physical Ledger device.
- Check the version shown on the device itself.
- Continue reviewing transaction details carefully on the device before approving them.
Updating device firmware alone is not enough to confirm that the affected Ethereum application has been replaced. The relevant protection is the Ethereum app version installed on the Ledger. 35
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "Ledger’s Ethereum App Bugs Explained: OneKey Reproduction, Fixes and What Users Should Do"?
Ledger’s August 2026 disclosures covered three Ethereum app flaws, not a reported private key or firmware compromise; the company says it found no evidence of user exploitation.
What are the key points to validate first?
Ledger’s August 2026 disclosures covered three Ethereum app flaws, not a reported private key or firmware compromise; the company says it found no evidence of user exploitation. OneKey reproduced LSB 023 against outdated app version 1.22.1 in a controlled lab.
What should I do next in practice?
LSB 024 could hide operations in a 257 item clear signing batch, while LSB 025 could substitute a token approval for a swap payment under narrow conditions.
Sources
cryptonews.netNo, Ledger Wasn’t Hacked: Vulnerable Ethereum App Was Patched Before Exploit, Company Says
cryptoslate.comLedger says the viral “hack” was already patched, but two ...
donjon.ledger.comLedger Security Bulletin 023
bingx.comLedger Rejects OneKey's "Hack" Claim After Old Ethereum App Bug ...