OneKey Claims It Hacked Ledger App, but Ledger Says Fix Already Existed

A dispute over a patched security flaw

Crypto wallet maker OneKey and cybersecurity firm Anzen claimed they successfully hacked version 1.22.1 of Ledger's Ethereum app. They demonstrated a transaction replacement attack that occurs while a user is reviewing a legitimate transaction.

However, Ledger disputes this claim. The hardware wallet company stated that "no Ledger user was hacked" and argued that reproducing a bug that was already fixed is not a real-world attack.

What each side is saying

OneKey founder Yishi Wang said his team reproduced the attack and warned Ledger users with the older Ethereum app to update their software. He noted that Ledger has already fixed the issue in version 1.22.3.

Ledger's Chief Technology Officer Charles Guillemet responded by saying that running an exploit against an old version after a fix has shipped is a "lab exercise, not a finding." A Ledger spokesperson told Protos that OneKey took previously disclosed findings and tried to replicate them in a controlled environment.

Ledger's internal security team, known as Donjon, claimed that the fix for this vulnerability was actually shipped on August 13 in version 1.22.2. This contradicts OneKey's implication that the issue was recently discovered rather than previously known.

The core disagreement

The main conflict comes down to timing and classification. OneKey is highlighting the existence of the vulnerability in older versions. Ledger is pointing out that the vulnerability was disclosed, patched, and distributed to users weeks ago.

Protos has reached out to OneKey for further comment and will update this story if they respond.

Why this matters

This situation highlights the difference between discovering a new hack and reproducing an old one. For Ledger users, the important takeaway is that keeping the Ethereum app updated to the latest version is essential. Users on older versions may still be exposed to risks that have already been addressed by the company.

Sources

• Protos