OneKey and Ledger dispute severity of patched Ethereum app vulnerability

Hardware wallet manufacturers OneKey and Ledger are engaged in a public dispute over the severity and framing of a security vulnerability that was patched in an older version of Ledger's Ethereum application. The conflict centers on a demonstration by OneKey's security team, which successfully reproduced a transaction replacement attack against Ledger Ethereum app version 1.22.1 in a controlled lab environment.

OneKey founder and CEO Yishi Wang announced the reproduction on August 27, stating his team exploited a race condition in the outdated app. This flaw could theoretically allow a malicious actor to swap a legitimate transaction for a harmful one while a user was reviewing it on the device's screen. Wang described the result by saying "we hacked Ledger" and noted the issue was fixed in Ethereum app version 1.22.3.

Ledger responded by rejecting the characterization of the event as a hack. Chief Technology Officer Charles Guillemet stated that reproducing a bug in an already-patched application is not hacking Ledger, calling the demonstration a "lab exercise run against an outdated app." Ledger emphasized that no user funds were lost and that the company has seen no evidence...