OneKey's Anzen security team reproduced a transaction-replacement attack on Ledger's Ethereum App version 1.22.1, according to founder Yishi. The attack exploits a race condition between display logic and the transaction buffer, allowing an attacker to overwrite a pending transaction while a user reviews a legitimate one, causing the device to sign a different transaction without displaying it to the user.
Ledger disclosed the issue in LSB 023, its security advisory published August 27. The bulletin states that some apps built with Ledger Secure SDK could receive new APDU commands during on-screen confirmation, causing displayed parameters to differ from those signed. Ledger attributed the flaw to the SDK's I/O handling rather than device firmware or the core operating system.
Yishi said Ledger patched the vulnerability in Ethereum App 1.22.3. Community notes on X disputed this claim, citing a TestMachine disclosure from August 22 showing the fix arrived in version 1.22.2. Ledger released SDK v26.6.1 on August 21 and required users to update apps through Ledger Live; firmware updates alone do not resolve the issue since the problem lies in app-level code.
The race condition allows an attacker to manipulate the timing between when a hardware wallet displays a transaction for user review and when it actually signs the data in its secure enclave. If an attacker can inject or replace the transaction in the buffer between these two events, the user may authorize what they see on screen while signing a different transaction. Ledger's fix added checks to prevent new commands from arriving during the confirmation window.
Ledger said it found no evidence of exploitation in the wild. The company did not specify how many users ran vulnerable app versions or how long the race condition existed before discovery. Hardware wallet vendors typically rely on user-initiated updates to patch application-level flaws, which means adoption of fixed versions depends on individual device owners running Ledger Live.
Yishi's public reproduction of the attack followed independent testing by OneKey's team of Ledger Donjon's patches. Ledger Donjon, the company's security research division, regularly discloses vulnerabilities and patches through its LSB bulletin series. The incident shows why application updates on hardware wallets require separate installation steps from firmware upgrades, since SDK vulnerabilities cannot be fixed at the OS level alone.
No other Ledger apps are confirmed affected by LSB 023. Users holding funds on devices running any affected Ledger app version should update immediately through Ledger Live to receive the patched app code.
