Ledger Bug Exposed: AI Firm Catches Flaw, Ledger Calls It 'Fear-Mongering'

TestMachine, an AI security firm, recently disclosed a bug in Ledger's Ethereum app. The flaw allowed malicious websites to trick users into signing transactions that were not intended.

The issue was discovered by Azimuth, an AI agent built by TestMachine. It found that the Ledger device would accept a second command while the user was still reviewing the first one, potentially leading to the approval of unintended transactions.

Ledger's CTO, Charles Guillemet, dismissed the disclosure as 'fear-mongering' and claimed that his team had already fixed the flaw quietly on August 12. He argued that TestMachine contacted the bounty program only after the patch was shipped, which he saw as a breach of security principles.

Guillemet emphasized the importance of responsible disclosure and verification before publishing findings. He also pointed out that Ledger's Donjon team had used AI tools to catch the bug earlier and had shipped the fix first.