OneKey Reproduces Transaction Replacement Attack on Ledger Ethereum App Version 1.22.1

Huo Xing Cai Jing reports that OneKey’s security team successfully replicated an exploit targeting the older version of the Ledger Ethereum app in a laboratory environment. Wang Yishi, founder and CEO of OneKey, stated that they executed a “transaction replacement attack” on Ledger Ethereum app version 1.22.1 by exploiting a previously patched vulnerability, allowing attackers to overwrite transactions awaiting signature while users review legitimate transactions. Ledger responded that exploiting this vulnerability requires control over communication between the device and host, such as through malware, compromised wallet software, or malicious websites. Ledger added application-layer protections in the Ethereum app version 1.22.2 released on August 13 and fixed the underlying issue in Secure SDK 26.6.1 on August 21. Ledger emphasized that no users have been compromised by this exploit; the incident was purely a laboratory reproduction. This security test followed the Coldcard vulnerability incident, during which certain Coldcard wallets were found to have security risks in mnemonic generation due to a firmware flaw. However, Ledger stated its devices were unaffected, as recovery phrases are generated by an authenticated random source embedded in the device’s secure chip. The vulnerability replicated by OneKey is unrelated to mnemonic generation and instead affects how transactions are processed during the signing process.