Open-source wallet provider OneKey announced that its in-house security team successfully reproduced an exploit targeting an outdated version of Ledger’s on-device Ethereum application in a test environment.
According to OneKey founder and CEO Yishi Wang, the team executed a transaction replacement attack against Ledger Ethereum app version 1.22.1. The attack leveraged a previously patched vulnerability that allowed malicious actors to overwrite a transaction waiting to be signed while a user was reviewing a legitimate transaction.
Ledger stated that exploiting the vulnerability required physical or digital control over communications between the device and its host, which could occur via malware, compromised wallet software, or a hostile webpage. The company implemented app-level safeguards with the release of Ethereum app version 1.22.2 on Aug. 13, and subsequently addressed the underlying issue in Secure SDK version 26.6.1 on Aug. 21.
In a social media statement on Thursday, Ledger emphasized that no user funds were lost. The company clarified that the incident was strictly a lab reproduction of a vulnerability affecting an outdated version of the Ethereum application.
Ledger also noted that the vulnerability reproduced by OneKey was entirely separate from seed generation processes, focusing instead on how transactions are handled during the signing phase.
