Ledger has released a fix for a vulnerability in its Ethereum app that could allow a malicious decentralized application to display one transaction while actually signing another. The company is urging users to update the Ledger Ethereum app to version 1.22.2, which closes the gap. The bug was discovered by Ledger's own security team, the Donjon, before an independent researcher reported it through the company's bug bounty program.
How the attack works
The vulnerability requires a dApp with WebHID access, a browser interface that lets websites talk to hardware wallets. Under the right conditions, the malicious dApp could replace a transaction in memory without opening a new review prompt. The original transaction details would remain on the screen while the device actually signs a replacement transaction — a classic blind-signing risk dressed up as a clear-signing check.
The issue was validated on Ledger Flex, and TestMachine, the firm that independently verified the bug, says the shared codebase extends it to the Nano X, Nano S Plus, Stax, and Apex devices. The earliest affected app release hasn't been disclosed, but the comparison starts from version 1.22.1.
Inside the patch
The fix in version 1.22.2 takes a two-pronged approach. It refuses to open a new signing session while a review is already active, and it rejects an approval callback when the state no longer matches what was originally presented. That way, a transaction swap can't happen without the device throwing an error.
Ledger's changelog dates version 1.22.2 to Aug. 12, with a signed tag on GitHub on Aug. 13. But the company's own security tool, TestMachine, said on Aug. 22 that the fix hadn't actually been released yet. Ledger CTO Charles Guillemet said on Aug. 23 that Donjon found the bug in "certain clear signing flows" and that the fix was deployed about two weeks earlier.
There's some disagreement over who found the bug first. Guillemet said Donjon spotted it before TestMachine contacted Ledger's bounty program, while TestMachine says its Azimuth system discovered and verified the issue independently. Either way, both sides agree the fix is what matters now.
No exploitation seen
So far there are no confirmed cases of this being exploited in the wild, no lost funds, and no private-key extraction linked to this flaw. That's the good news. The bad news is that users who haven't updated are still exposed, and the fix wasn't pushed out to everyone immediately.
This bug is separate from the native Zilliqa Ledger app flaw that involved Schnorr nonce leakage, and it's also unrelated to the 2023 Connect Kit compromise. It's a distinct problem that needed its own patch.
The next concrete step is for users to update the Ethereum app to 1.22.2 on their Ledger devices. The company's changelog makes it clear the fix is ready, and the gap between the changelog date and the actual release is the kind of thing that will get resolved once the update hits everyone's devices. Until then, holding off on signing anything that looks slightly off is probably a decent habit.
