OneKey Demonstrates Transaction Replacement Attack on Ledger Ethereum Application

OneKey's security team has successfully replicated a vulnerability in the old version of the Ledger Ethereum application, specifically version 1.22.1. The demonstration involved executing a transaction replacement attack, which allowed the team to overwrite pending transactions while users were reviewing legitimate ones. This vulnerability was previously patched, but OneKey's founder and CEO, Wang Yishi, confirmed that it could still be exploited under certain conditions.

Ledger has responded to the findings, stating that exploiting this vulnerability requires control over the communication between the device and the host, which could be achieved through malware, compromised wallet software, or malicious web pages. The company released an updated version of the Ethereum application, version 1.22.2, on August 13, which includes application layer protections, and addressed the underlying issue in Secure SDK 26.6.1 on August 21.

Ledger emphasized that no users were hacked as a result of this replication, clarifying that it was conducted in a controlled laboratory environment. This incident follows a recent vulnerability found in the Coldcard wallet, which raised concerns about mnemonic phrase generation. However, Ledger assured that its devices were not affected by that issue, as recovery phrases are generated by a certified random source within the device's secure chip. The vulnerability replicated by OneKey pertains specifically to transaction processing during the signing process.

© 2026 KLEA News. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

Source: KLEA News