- Published on
OneKey reproduces transaction replacement attack on outdated Ledger Ethereum app
- Authors
- Name
- DeepHorus
Open-source wallet provider OneKey has announced it successfully reproduced a security exploit targeting an outdated version of Ledger's Ethereum application in a controlled lab environment. The test demonstrated a "transaction replacement attack" against Ledger Ethereum app version 1.22.1. This vulnerability could allow an attacker to overwrite a pending transaction while a user was still reviewing it on their device.
The exploit, disclosed by OneKey founder and CEO Yishi Wang, leverages a previously patched flaw that permits transaction manipulation during the signing process. For the attack to succeed, an adversary would need control over communication between the Ledger device and its host computer. This control could potentially be achieved through malware, compromised wallet software, or a malicious webpage.
Ledger has confirmed the vulnerability existed but emphasized it has been fixed. The company released app-level safeguards in Ethereum app version 1.22.2 on August 13, 2024. A broader fix in the underlying Secure SDK 26.6.1 followed on August 21.
In a statement posted on X, Ledger clarified the incident's limited scope. "No Ledger user was hacked. What's described here is a lab reproduction of a vulnerability in an outdated version of the Ethereum app," the company wrote. It stressed that the test did not result in any loss of user funds.
This security disclosure comes shortly after a separate incident involving Coldcard wallets. In July, attackers exploited a firmware bug to compromise seed randomness on some devices. Ledger previously stated its own devices were unaffected by the Coldcard issue due to their use of a certified randomness source.
The OneKey test specifically highlights a different class of risk related to transaction handling, not seed phrase generation. The exercise underscores the importance of keeping hardware wallet firmware and applications updated to the latest versions. Users are urged to apply the available patches promptly.
Looking ahead, the incident reinforces ongoing security challenges in the cryptocurrency hardware wallet space. Continuous vigilance, independent testing, and timely patching remain critical for protecting digital assets. The collaboration and disclosure between competing firms like OneKey and Ledger contribute to the overall security ecosystem.
