Ledger quietly patched a vulnerability in its Ethereum hardware wallet app on August 12 that could have allowed a malicious decentralized application to swap out a legitimate transaction for a harmful one mid-signing. The fix shipped in Ethereum app version 1.22.2, but the company said almost nothing about it publicly until a security researcher forced the conversation.
The bug involved an APDU command race condition, a type of flaw where competing instructions can arrive at the device in a sequence that tricks the signing process. In practical terms, a user could have thought they were approving a small token transfer while actually authorizing unlimited token approvals to an attacker-controlled address.
How the vulnerability worked
APDU stands for Application Protocol Data Unit, essentially the language that software on your computer uses to talk to the secure chip inside a Ledger device. During what Ledger calls “clear signing” flows, where the device displays human-readable transaction details on its screen, the race condition could have allowed a second, malicious APDU command to slip in and replace the original transaction data.
The attack would have required a compromised or malicious dApp to exploit the timing window. A user interacting with a trusted, legitimate application would not have been at risk.
Ledger’s internal security team, known as Donjon, discovered the flaw before any external researcher flagged it. The company said Donjon used AI-assisted tools to identify and resolve the issue.
The disclosure drama
The patch landed on August 12 without fanfare. No security advisory, no blog post, no tweet thread. For about ten days, the fix existed in the wild with almost zero public awareness.
That changed between August 21 and 23, when a security researcher operating under the name TestMachine publicly disclosed the bug. TestMachine detailed the potential for transaction substitution and the mechanics of the race condition, drawing attention to a vulnerability that most Ledger users had no idea existed, let alone had been fixed.
TestMachine reportedly declined a bounty offer from Ledger.
Ledger CTO Charles Guillemet pushed back on the public disclosure, characterizing it as fear-mongering. Guillemet emphasized that any user running the latest version of the Ethereum app was already protected and that the vulnerability had been addressed before TestMachine’s public notice.
Clear signing and the bigger picture
The vulnerability is particularly notable because it affected Ledger’s clear signing flows, the very feature designed to protect users from blind signing risks. Ledger has invested heavily in making clear signing the default, including previous work with the ERC-7730 standard aimed at standardizing how transaction data is displayed on hardware wallets.
No reports of funds lost to this vulnerability have surfaced. The patch was deployed proactively by Donjon before any external notice was filed.
For Ledger users, the immediate takeaway is straightforward: update your Ethereum app to version 1.22.2 or later if you haven’t already.