Ledger Says Ethereum App Flaw Patched Before Public Disclosure

Ledger has confirmed that a critical vulnerability in its Ethereum application, which could have allowed malicious actors to manipulate transaction details during user approval, was patched two weeks before a security researcher publicly disclosed the issue. The company's Chief Technology Officer, Charles Guillemet, stated on August 23 that the fix was deployed on August 12, 2026, and accused the researcher of "manufacturing fear for attention."

The flaw affected the "clear signing" process, a security feature designed to display transaction information in a human-readable format on the Ledger device screen. According to technical descriptions, the vulnerability involved a race condition in the communication between the device and connected software. This could potentially allow a competing malicious command to replace a legitimate transaction with a fraudulent one while a user was reviewing it on the screen, such as swapping a small token transfer for an unlimited approval to an attacker's address.

Ledger's internal security team, known as Donjon, discovered the issue using AI-assisted research tools and released a patch in Ethereum app version 1.22.2. However, the company did...