OneKey successfully reproduced an exploit against an outdated version of the Ethereum application for Ledger hardware wallets in a controlled test environment. OneKey founder and CEO Yishi Wang reported successfully carrying out a “transaction replacement attack” against Ledger Ethereum app version 1.22.1 by exploiting a previously patched vulnerability.
Key fact: The vulnerability allows an attacker to overwrite a transaction awaiting signature while the user is still reviewing a legitimate transaction on the device screen. No Ledger user was hacked — this was a laboratory reproduction of the exploit.
The vulnerability belongs to a class of attacks targeting the transaction-signing process in hardware wallets. An attacker can replace the contents of a transaction while the user sees one transaction on the device screen for verification but ultimately signs a different, malicious one.
The transaction-signing process on a hardware wallet involves several stages:
The vulnerability in Ledger Ethereum app 1.22.1 allowed an attacker to replace the transaction between the display and signing stages. The user could see a legitimate transaction — for example, sending 0.1 ETH to another address they control — while actually signing a malicious transaction, such as transferring all available funds to the attacker.
According to Ledger, exploiting the vulnerability requires control over communication between the device and the host. This could potentially be achieved through:
Important limitation: The vulnerability cannot be exploited remotely without prior control over the host system. This significantly reduces its practical attack surface, though it does not make the issue harmless.
Ledger responded quickly to disclosure of the vulnerability, releasing fixes at two different levels.
The company released Ethereum app version 1.22.2, which includes additional application-level safeguards. These protections prevent transaction replacement during the signing process even when the host system has been compromised.
A more fundamental fix was introduced in Secure SDK version 26.6.1. This update addresses the underlying cause of the vulnerability at the device software level, preventing this class of attack at a lower layer of the architecture.
Ledger published a statement on X, formerly Twitter:
“No Ledger user was hacked. What is being described here is a laboratory reproduction of a vulnerability in an outdated version of the Ethereum application.”
The company emphasized that the issue affects outdated software and does not represent a threat to users who have updated their devices and applications to current versions.
It is important to distinguish the vulnerability reproduced by OneKey from seed phrase generation issues. This flaw affects only transaction processing during signing and is unrelated to how wallet seeds are generated.
Seed generation flaws are generally more severe because they can potentially compromise every asset associated with a wallet:
Transaction-signing vulnerabilities affect specific operations rather than the underlying wallet secret:
Critical distinction: A transaction replacement vulnerability requires active user participation at the time of the attack as well as control over the host environment. Seed generation flaws can compromise the entire wallet without any additional action from the user.
OneKey, a competing hardware wallet manufacturer, played an important role in identifying and demonstrating the issue. The company reproduced the exploit in a controlled environment, helping Ledger assess the practical scope of the problem and deploy fixes.
The vulnerability disclosure process followed responsible disclosure principles:
OneKey’s actions demonstrate the importance of independent security research across the cryptocurrency industry:
The Ledger incident comes amid increased scrutiny of hardware wallet security following a series of issues across the industry in 2025 and 2026.
Modern attacks against hardware wallets can target several layers:
Hardware wallet manufacturers continue to improve protection through:
2026 trend: The industry is moving toward a defense-in-depth model in which every layer of the system has its own protection mechanisms, creating multiple barriers against compromise.
Although Ledger says no users were hacked through this vulnerability, the incident highlights the importance of proactive security practices.
Potential warning signs include:
The Ledger incident provides important lessons for developers of hardware wallets and blockchain applications.
Effective security testing should include:
Key principle: Security is not a fixed state but a continuous process. Even the strongest systems can contain vulnerabilities, making rapid detection and remediation essential.
Public disclosure of vulnerabilities can influence how both retail users and institutional investors perceive hardware wallet security.
The industry continues to search for the right balance between:
The Ledger incident is likely to accelerate the adoption of more sophisticated security mechanisms in hardware wallets.
Regulatory attention is also likely to increase:
Users are also becoming more security-conscious:
Outlook: By 2027, hardware wallets are likely to become significantly more resilient through a combination of improved hardware design, more sophisticated software protections and better-informed users.
A wide range of educational materials is available for users who want to improve their security awareness.
The transaction replacement vulnerability in Ledger Ethereum app 1.22.1 demonstrates that even leading hardware wallet manufacturers are not immune to security issues. At the same time, rapid discovery, transparent disclosure and prompt remediation show the growing maturity of security processes across the industry.
Key lessons from the incident include:
For Ledger users, the incident is another reminder to keep devices and applications updated and maintain strong overall security hygiene. Although exploitation required control over the host system, significantly reducing the practical attack surface, the issue demonstrates why hardware wallet security cannot be considered in isolation from the computer and software environment around it.
Strategic lesson: In a world where threats constantly evolve, security is not a product that can be purchased once. It is an ongoing process that requires continuous attention and adaptation.
For the broader industry, the case demonstrates the value of collaboration between companies, researchers and users. OneKey, despite being a Ledger competitor, played a constructive role in strengthening security across the hardware wallet ecosystem, ultimately benefiting users of every platform.
The future of hardware wallet security depends on continued innovation, transparency and education. Manufacturers will keep improving technical defenses, users will become increasingly security-conscious, and the industry as a whole will continue developing stronger standards and best practices.
Despite its seriousness, the Ledger incident provides another opportunity for the ecosystem to reassess security assumptions and improve its practices. Every vulnerability that is responsibly disclosed and fixed contributes to collective knowledge and helps create a safer environment for cryptocurrency users.
Ultimately, the maturity of the crypto industry will not be measured by the complete absence of security incidents, but by its ability to prevent them where possible, respond rapidly when they occur and learn enough from each one to reduce the likelihood of future failures. In that respect, the Ledger incident shows an ecosystem moving toward stronger, more transparent and more resilient security practices.
“Security is not a destination, but a journey. In cryptography, the winners are not those who never encounter vulnerabilities, but those who prepare for them, respond quickly and learn from every incident.”
— Bruce Schneier, renowned cryptographer and security expert
