OneKey Team Discovers Vulnerability in Ledger's Ethereum Wallet App

A OneKey team discovered a vulnerability in Ledger's wallet, specifically in the Ethereum app running on an older version.

The team successfully reproduced the attack in a test environment using a 'transaction replacement' tactic that exploits a previously fixed weakness in the app. This allows attackers to overwrite an unsigned transaction while the user is still reviewing it.

According to Ledger, exploiting this vulnerability requires control over the communication between the device and computer, such as through malicious software or compromised accounts. Ledger has since addressed the issue with a patch released for the Ethereum app on August 13, version 1.22.2, before fixing the underlying problem in Secure SDK 26.6.1 on August 21.