Ledger quietly patched a vulnerability in its Ethereum hardware wallet app on August 12 that could have allowed a malicious decentralized application to swap a legitimate transaction for a harmful one during signing. The fix was included in Ethereum app version 1.22.2, though the company said little about it publicly until a security researcher brought the issue to attention.

The flaw involved an APDU command race condition, a type of vulnerability in which competing instructions can reach the device in an order that interferes with the signing process. In practical terms, a user could have believed they were approving a small token transfer while actually authorizing unlimited token approvals to an attacker-controlled address.

How the vulnerability worked

APDU stands for Application Protocol Data Unit, the communication format software on a computer uses to talk to the secure chip inside a Ledger device. During Ledger’s “clear signing” flows, in which the device displays human-readable transaction details on its screen, the race condition could have allowed a second, malicious APDU command to slip in and replace the original transaction data.

The attack required a compromised or malicious dApp to exploit the timing window. A user interacting with a trusted, legitimate application would not have been exposed to the issue.

Ledger’s internal security team, known as Donjon, discovered the flaw before any external researcher identified it. The company said Donjon used AI-assisted tools to find and resolve the problem.

Public disclosure followed the patch

The patch was released on August 12 without a security advisory, blog post, or public post on X. For about 10 days, the fix was in place with little public awareness.

That changed between August 21 and 23, when a security researcher using the name TestMachine publicly disclosed the bug. TestMachine described the transaction substitution risk and the mechanics of the race condition, bringing attention to a vulnerability that most Ledger users did not know had existed, much less been fixed.

TestMachine reportedly declined a bounty offer from Ledger.

Ledger CTO Charles Guillemet pushed back on the public disclosure and described it as fear-mongering. Guillemet said users running the latest version of the Ethereum app were already protected and that Ledger had addressed the issue before TestMachine’s disclosure.

Clear signing and broader context

The vulnerability was notable because it affected Ledger’s clear signing flows, the feature intended to reduce the risks of blind signing. Ledger has invested heavily in making clear signing the default, including earlier work with the ERC-7730 standard, which is designed to standardize how transaction data is displayed on hardware wallets. That makes this issue relevant beyond a single bug report: it sits at the intersection of wallet security, transaction readability, and the long-running effort to make on-device signing easier to verify before users approve a request.

There have been no reports of funds being lost because of this vulnerability. Ledger said the patch was deployed proactively by Donjon before any external notice was filed. For users and developers who rely on hardware wallets in Ethereum-based workflows, the episode also underscores why app updates matter even when the underlying device firmware is unchanged.

For Ledger users, the immediate takeaway is simple: update the Ethereum app to version 1.22.2 or later if it is not already installed.