No, Ledger Wasn’t Hacked: Vulnerable Ethereum App Was Patched Before Exploit, Company Says

Security researcher OneKey claimed to have identified a vulnerability in Ledger's Ethereum app where the device could sign a transaction different from what appeared on its screen - a serious concern for hardware wallet users who rely on display verification. Ledger acknowledged the flaw existed but stated it had already patched the issue before OneKey publicized the discovery. The company disputed OneKey's characterization, saying the team merely replicated already-known findings rather than conducting an independent exploit.

The dispute centers on timing and attribution. OneKey's Anzen security team framed its work as a successful hack, while Ledger positioned the disclosure as after-the-fact validation of a problem it had resolved. Neither party disputes the vulnerability itself existed; the disagreement is whether OneKey discovered it or demonstrated a pre-existing weakness.

• Ledger's Ethereum app contained a flaw allowing mismatched transaction signing, but the company claims it was patched before public disclosure.
• OneKey and Ledger contest whether the security team uncovered a new vulnerability or simply reproduced a known issue Ledger had already fixed.
• The incident highlights the importance of coordinated disclosure timelines in hardware wallet security.