Version

Change

Security

Ethereum

Bitcoin Red

<p>Ledger has patched a vulnerability in its Ethereum hardware-wallet app that could allow a malicious dApp to replace a transaction during the approval process while the device continued showing users the transaction they originally reviewed.</p>
<p>Security firm TestMachine <a href="https://x.com/testmachine_ai/status/2090954980635164965" rel="noopener noreferrer nofollow">disclosed the signature-substitution flaw</a> on August 21 after reproducing it on Ledger hardware. Ledger had already shipped Ethereum app version 1.22.2 on August 12, with its <a href="https://github.com/LedgerHQ/app-ethereum/blob/develop/CHANGELOG.md" rel="noopener noreferrer nofollow">release history</a> listing security fixes for the update.</p>
<h2 id="malicious-dapp-could-change-the-transaction-before-signing">Malicious dApp Could Change the Transaction Before Signing</h2>
<p>The flaw affected the command flow between a connected dApp and Ledger’s Ethereum application. A malicious application with direct device access through WebHID could interfere while a transaction review remained open, replacing the <a href="https://cryptoadventure.com/transaction-signing-explained-what-wallet-signatures-do-and-how-to-avoid-signing-traps/" rel="noopener noreferrer nofollow">signing context before the user approved it</a>.</p>
<p>The device could therefore continue displaying the original transaction while preparing a different transaction for the final signature. TestMachine demonstrated the issue using a benign ETH transfer that could be substituted with a <a href="https://cryptoadventure.com/community/articles/token-approvals-in-crypto-what-they-are-and-how-they-work/" rel="noopener noreferrer nofollow">token approval</a>, creating a path for users to authorize something different from the transaction shown on the hardware screen.</p>
<p>Version 1.22.2 blocks competing signing commands while a review is pending and tightens how the application maintains signing state during the approval flow. The fix preserves the link between the transaction displayed on the secure screen and the transaction ultimately signed by the device.</p>
<h2 id="ledger-says-donjon-found-the-bug-before-disclosure">Ledger Says Donjon Found the Bug Before Disclosure</h2>
<p>Ledger CTO Charles Guillemet said the company’s Donjon security team had already <a href="https://x.com/P3b7_/status/2091585430030344262" rel="noopener noreferrer nofollow">identified and fixed the bug</a> roughly two weeks before TestMachine published its findings, using AI-assisted security tools during the review.</p>
<p>Guillemet also criticized the disclosure process, saying TestMachine contacted Ledger’s bounty program after the patch had already shipped and then published its findings without completing the normal responsible-disclosure process. Users running current device firmware and Ethereum app version 1.22.2 are protected against the flaw.</p>
<p>The discovery adds another example of AI entering wallet-security review. A recent <a href="https://cryptoadventure.com/bitcoin-red-team-flags-7958-security-issues-across-501-projects/" rel="noopener noreferrer nofollow">Bitcoin Red Team audit</a> used AI-assisted analysis alongside human researchers to identify thousands of potential security issues across Bitcoin wallets and infrastructure.</p>
<h2 id="hardware-wallet-vendors-push-security-updates">Hardware Wallet Vendors Push Security Updates</h2>
<p>Ledger’s fix arrives less than a week after BitBox released firmware 9.26.5 to patch <a href="https://cryptoadventure.com/bitbox-fixes-two-severe-hardware-wallet-vulnerabilities-in-dixence-update/" rel="noopener noreferrer nofollow">two severe vulnerabilities</a>, including a memory-corruption flaw that could allow arbitrary code execution under specific conditions.</p>
<p>Hardware-wallet security has faced heavier scrutiny since the Coldcard seed-generation failure exposed wallets created with insufficient randomness. The resulting <a href="https://cryptoadventure.com/coldcard-hack-may-reach-132m-as-at-least-15-attackers-target-wallets/" rel="noopener noreferrer nofollow">Bitcoin drains</a> were estimated at as much as $132 million as multiple attackers raced to identify vulnerable addresses.</p>
<p>Ledger’s Ethereum app <strong>1.22.2</strong>, released August 12, is the patched version covering the newly disclosed signing flaw.</p>
<p>The post <a href="https://cryptoadventure.com/ledger-patches-ethereum-signing-flaw-before-researchers-disclose-it/" rel="noopener noreferrer nofollow">Ledger Patches Ethereum Signing Flaw Before Researchers Disclose It</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.</p>

Ledger Patches Ethereum Signing Flaw Before Researchers Disclose It

Table of Contents

Crypto Adventure

Other articles published on Aug 24, 2026

Join our free newsletter for daily crypto updates!