@cvhessert ↔ @Ledger conversation
cvh@cvhessert
92 views
Aug 26, 2026
~1 min read
Advertisement
cvh@cvhessert
🚨Critical security update for LEDGER hardware wallets
A critical vulnerability has been identified in the Ethereum app on Ledger hardware wallets. It could allow a malicious application to alter the details of a transaction during signing, without this being visible on the device screen.
This has been fixed in Ethereum app version 1.22.2. If you use a Ledger device, please update ASAP
While you're in there, it's also good practice to make sure Ledger Live and your device firmware are fully up to date.
A critical vulnerability has been identified in the Ethereum app on Ledger hardware wallets. It could allow a malicious application to alter the details of a transaction during signing, without this being visible on the device screen.
This has been fixed in Ethereum app version 1.22.2. If you use a Ledger device, please update ASAP
While you're in there, it's also good practice to make sure Ledger Live and your device firmware are fully up to date.
Ledger@Ledger
Ledger CTO, Charles Guillemet, has already addressed this in a comprehensive thread (see link below).
As part of our standard security process, the Ledger Donjon, our in-house security research team, identified a bug affecting certain clear signing flows in the Ledger signer Ethereum app and patched it on August 12th, two weeks before public disclosure. This reflects our security-first approach: continuous internal research, rapid remediation and responsible disclosure.
Proactively discovering and patching vulnerabilities through regular firmware and app updates is routine at Ledger. The Donjon leverages advanced AI on an ongoing basis to find and fix issues as rapidly as possible, minimising risk to users.
If you're on the latest version of the Ethereum app (1.22.2) the patch is applied and you benefit from the fix. This highlights the importance of keeping your signer firmware and apps always up to date.
More details:
[What about Ledger Nano S users?]
This specific Ethereum bug didn't apply to the Ledger Nano S, but it's recommended to always update to the most recent supported versions of apps and firmware.
As part of our standard security process, the Ledger Donjon, our in-house security research team, identified a bug affecting certain clear signing flows in the Ledger signer Ethereum app and patched it on August 12th, two weeks before public disclosure. This reflects our security-first approach: continuous internal research, rapid remediation and responsible disclosure.
Proactively discovering and patching vulnerabilities through regular firmware and app updates is routine at Ledger. The Donjon leverages advanced AI on an ongoing basis to find and fix issues as rapidly as possible, minimising risk to users.
If you're on the latest version of the Ethereum app (1.22.2) the patch is applied and you benefit from the fix. This highlights the importance of keeping your signer firmware and apps always up to date.
More details:
[What about Ledger Nano S users?]
This specific Ethereum bug didn't apply to the Ledger Nano S, but it's recommended to always update to the most recent supported versions of apps and firmware.
Charles Guillemet@P3b7_
There's some FUD circulating about Ledger signers, pushed by a "smart contract security" company claiming a vulnerability in the Ledger Ethereum app.
There was a bug concerning certain clear signing flows. It was found by the @DonjonLedger using their AI-powered vulnerability research suite. It was fixed and deployed two weeks ago. If you keep your Ledger apps up to date, you are protected. That's the whole story.
Now the framing.
What actually happened: this company reached out to our bounty program after the fix was already shipped, and did not follow responsible disclosure, they actually never discussed with the bounty program team. Then they published a thread implying the problem is unsolved. It is not. That's not security research. That's manufacturing fear for attention.
Here is the uncomfortable part. AI changes the security landscape for everyone, defenders and attackers alike. The @DonjonLedger is leading on exactly this: using AI to find real bugs before they reach users. But AI-speed research only makes the ecosystem safer if the people doing it still follow basic security principles. Disclose responsibly. Verify before you publish. Don't confuse noise with a finding.
An actor who skips all of that is net negative for the ecosystem, regardless of the tooling behind them.
The takeaway for you is simple. Keep your Ledger signers up to date (update the FW, update the apps), keep your software up to date in general, and you benefit from the latest security work automatically. Ignore the FUD.
Stay safe.
There was a bug concerning certain clear signing flows. It was found by the @DonjonLedger using their AI-powered vulnerability research suite. It was fixed and deployed two weeks ago. If you keep your Ledger apps up to date, you are protected. That's the whole story.
Now the framing.
What actually happened: this company reached out to our bounty program after the fix was already shipped, and did not follow responsible disclosure, they actually never discussed with the bounty program team. Then they published a thread implying the problem is unsolved. It is not. That's not security research. That's manufacturing fear for attention.
Here is the uncomfortable part. AI changes the security landscape for everyone, defenders and attackers alike. The @DonjonLedger is leading on exactly this: using AI to find real bugs before they reach users. But AI-speed research only makes the ecosystem safer if the people doing it still follow basic security principles. Disclose responsibly. Verify before you publish. Don't confuse noise with a finding.
An actor who skips all of that is net negative for the ecosystem, regardless of the tooling behind them.
The takeaway for you is simple. Keep your Ledger signers up to date (update the FW, update the apps), keep your software up to date in general, and you benefit from the latest security work automatically. Ignore the FUD.
Stay safe.
