Checking only the first 4 and last 4 characters of a wallet address is no longer enough. In this address-poisoning case, a user first sent 100 USDT as a test. The attacker then generated a lookalike address and sent 1.01 USDT to the victim—just to place the fake address in their transaction history. Minutes later, the wrong address was copied. ~2.5M USDT was gone. No private key was stolen. No wallet was hacked. One address was simply mistaken for another. This is why transaction verification matters: check more of the address, verify on-device, and never blindly copy from transaction history. Security should protect the decision—not just the key. #UnionKey #CryptoSecurity #AddressPoisoning #SelfCustody

Comprehensive updates to Sparrow Wallet. Following the Coldcard incident, there were likely a large number of AI-generated reports. In preparation for future AI-driven attacks, Craig Raw personally conducted a full self-audit and proactively addressed all necessary areas. He also stated: “Don’t just send me everything you don’t understand as a vulnerability.”

The founder of OneKey claims that his team successfully hacked Ledger, the largest hardware wallet provider. If this can be technically verified, it would be a strong indication that even established hardware wallets are not inherently immune to attacks. Especially with devices that users rely on for their perceived high security, such claims should be carefully examined rather than dismissed outright as marketing. 🧐

BREAKING : 🚨🚨 OneKey Founder Says Team “Hacked” the Largest Hardware Wallet, Ledger OneKey founder Yishi said the OneKey Anzen team reproduced a transaction-replacement attack on Ledger Ethereum App 1.22.1 in the lab.

🚨 LATEST: Ledger rejects “hack” claims after OneKey reproduced a transaction-replacement attack on Ethereum App 1.22.1 in a lab. 🔒 ⚡️ OneKey says the flaw could make a Ledger display one transaction while signing another.  ⚡️ Ledger’s LSB-023 confirms the underlying SDK issue was fixed through app updates and Secure SDK v26.6.1, with no evidence of exploitation. #Ledger #OneKey #Ethereum #HardwareWallet #CryptoNews

Has OneKey breached Ledger’s celebrated security防线? @OneKeyHQ’s Anzen security team successfully replicated a Ledger transaction replacement attack in the lab: users are prompted to confirm Transaction A, but the device ultimately signs Transaction B—without any visible anomaly on the screen. If the computer is compromised by malware, attackers can exploit the confirmation window to swap parameters, creating a disconnect between what’s displayed and what’s actually signed. @Ledger states the issue has been patched: the Ethereum App 1.22.2, released on August 13, introduced application-layer state protection for the first time; SDK v26.6.1, released on August 21, blocked instruction injection at the firmware level. Users are now urged to upgrade immediately to version 1.22.3 or higher.

Reproduction of Transaction Replacement Attack on OneKey and Ledger Wallets • The OneKey Anzen team reproduced a transaction replacement attack on Ledger Ethereum App 1.22.1 • The vulnerability stems from a race condition between the display logic and the transaction buffer • Reveals a potential security flaw in Ledger hardware wallets