# Ledger Patched a Flaw That Could Have Made Its Ethereum App Sign a Transaction Different From the One Displayed

The fix shipped on 12 August in app version 1.22.2, and Ledger and the researchers who published the finding disagree publicly over who found it and how serious it was.

- Published: 2026-08-25T05:50:40.344Z
- Canonical: https://polylog.news/crypto/2026-08-25/ledger-patched-a-flaw-that-could-have-made-its-ethereum-app
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CryptoSlate](https://cryptoslate.com/ledger-patched-an-ethereum-app-bug-that-could-show-one-transaction-and-sign-another/), [Blockstream Blog](https://blog.blockstream.com/blockstream-app-desktop-3-5-0/)

Ledger fixed a defect in the Ethereum application on its hardware wallets that could allow a malicious website to substitute transaction data while a user was reviewing a payment on the device screen. [CryptoSlate reports](https://cryptoslate.com/ledger-patched-an-ethereum-app-bug-that-could-show-one-transaction-and-sign-another/) that version 1.22.2 adds two signing-state safeguards, rejecting signature commands that arrive while a review is still open and fixing the signing mode at the start of an operation. The reported attack path is a race between commands sent to the device over a browser connection, which is why the flaw affected the clear-signing flow, the feature marketed precisely to stop users approving contents they cannot read.

The two sides tell different stories about discovery. Ledger's chief technology officer, Charles Guillemet, [said the company's internal Donjon security team found the bug with an artificial-intelligence vulnerability research system and shipped the fix before the public warning](https://crypto.news/ledger-says-ethereum-signing-flaw-was-already-fixed/), and he characterized the disclosure as [manufacturing fear for attention](https://ambcrypto.com/ledger-pushes-back-on-ethereum-app-flaw-claims-manufacturing-fear-for-attention/). The researchers operating as TestMachine say their own automated system found the issue and that they shared and verified it with Ledger. No reports of lost funds have surfaced. CryptoSlate notes that public physical validation of the substitution path is limited to one device model, the Ledger Flex, so the real-world reach across the product line is documented less thoroughly than the patch is.

Both accounts point to the same underlying condition. Automated code analysis is now finding implementation faults in signing firmware faster than the disclosure norms of the industry can absorb them, and the argument moves to timing and credit rather than to whether the defect was real.

The engineering response elsewhere is to remove the attack surface rather than try to manage it after the fact. Blockstream [shipped desktop version 3.5.0 of its application](https://blog.blockstream.com/blockstream-app-desktop-3-5-0/) with fully air-gapped signing for its Jade device over scanned codes, alongside Lightning payments in beta. A signer with no live data connection to the host computer cannot lose a race with commands sent by that computer.

## What this means

The value of a hardware wallet rests on one claim, that the screen shows what the key signs. Each implementation defect in that path transfers demand from self-custody to custodians and exchange-traded products, because holders who cannot audit firmware react to uncertainty by outsourcing it. The commercial winners are regulated custodians and issuers, and the losers are device makers whose premium depends on a trust story that automated code review keeps testing.

## What to watch

- Whether independent researchers reproduce the substitution path on Ledger models other than the Flex, which would settle how far the exposure extended.
- Whether Ledger and other device makers change disclosure policy after this dispute, since embargo terms determine how long users hold vulnerable firmware without knowing.
- Whether air-gapped signing over scanned codes spreads to more wallets, which would show the industry treating live host connections as the flaw rather than the convenience.