OneKey’s security team says it has reproduced an attack that can swap out a transaction on a Ledger hardware wallet while the owner is still reviewing it. Ledger rejects the framing. The company says researchers demonstrated the trick against an outdated version of the Ethereum app that was patched weeks before the demo went public, and that no user lost funds.
The dispute started when Yishi Wang, founder and chief executive of OneKey, said his company’s Anzen team had completed a “transaction replacement attack” against Ledger’s Ethereum app version 1.22.1 in laboratory conditions. The bug is a race condition between the code that displays a transaction for approval and the buffer that holds the transaction data itself. An attacker who wins the race can overwrite the transaction waiting to be signed after the user has checked what is on the screen. The victim approves a payment to one address and signs a payment to another.
Ledger confirmed the underlying flaw but disputed the timeline and the label. The company said exploiting it required control over the channel between the device and the computer or phone it is connected to. It listed malware on the host, a compromised wallet application or a hostile webpage with WebHID or WebUSB access as the practical routes in. An unplugged device cannot be attacked remotely, and the attack could not be performed against a device sitting in a drawer.
Ledger chief technology officer Charles Guillemet went further, arguing that “reproducing an already-patched bug is not ‘hacking Ledger'” and characterizing OneKey’s work as a laboratory exercise against an older application.
“No Ledger user was hacked. What’s described here is a lab reproduction of a vulnerability in an outdated version of the Ethereum app,” Ledger wrote in a statement on X.
Patched twice before the demo
The version history is central to the argument. Ledger shipped Ethereum app 1.22.2 on Aug. 13 with safeguards at the application level, then closed the underlying issue in Secure SDK 26.6.1 on Aug. 21, a component shared across device apps. The SDK fix blocks interleaved commands before they reach individual applications on the device. Ledger now recommends version 1.22.3 or later, which carries the SDK protection and also patches a second transaction-display flaw.
OneKey was right that 1.22.3 is protected, but the first application-level fix landed in 1.22.2, before Wang’s public description. Ledger says that ordering matters: the demonstration targeted code that was already fixed for anyone who had updated their apps. Wang countered that the point of the exercise was to show what a race condition of this class looks like, not to claim current firmware was vulnerable.
Under the hood, Ledger applications receive instructions called Application Protocol Data Unit commands, or APDUs, from wallet software, webpages or other interfaces on the host machine. The flaw lived in how those commands interleaved with the display logic during signing. Anyone who controlled that channel could inject a second transaction while the first was still on screen. The weakness was unrelated to seed generation, which is a separate and more sensitive code path handled inside the secure element.
Why the fight matters
Hardware wallets sell a simple promise: what you see on the device screen is what you sign. A transaction replacement attack breaks that promise at the last step, the one moment users are told to trust the display. That is why both companies are spending more energy on the wording than on the bug itself, which is already dead.
Ledger said it found no evidence the vulnerability was ever exploited against real users or caused losses anywhere. The attack also needed prerequisites most victims would not have: malware or a malicious page already running with device access. In practice the scenario overlaps with ordinary host compromise, which security teams treat as game over for most setups anyway.
There is a competitive edge here too. OneKey positions itself as an open-source wallet maker, and a public reproduction of a rival’s flaw is a marketing event as much as a disclosure. Ledger, the market leader in hardware wallets, has spent 2026 batting away security claims, including an earlier statement that its devices were unaffected by a Coldcard vulnerability because seed phrases are generated from a certified random source inside the secure chip.
Responsible disclosure between competitors is rarely this public. Most labs report flaws privately and let the vendor coordinate a patch, with a joint publication once users are protected. Wang chose a public demonstration, which forced Ledger into a same-day rebuttal and gave the story a second life. Security researchers have argued for years about this tradeoff: public demos pressure vendors to fix faster, but they also hand attackers a map. The rise of bounty programs and live exploit showcases at conferences has pushed the industry toward public demos, and wallet makers have become regular participants.
The episode also lands in a crowded season for wallet security news. Fake desktop apps are spreading crypto-stealing malware, state-linked addresses have moved stolen funds through decentralized exchanges, and clipboard-hijacking malware that swaps wallet addresses remains a routine nuisance. Against that backdrop, a lab-only race condition on outdated firmware is a minor threat, but it touches the trust model that sells the product.
For users the practical takeaway is narrow. Update the Ledger Ethereum app to 1.22.3 or later, install the current Secure SDK, and treat any prompt to connect a hardware wallet from an unfamiliar webpage as hostile. Ledger also advises verifying the full transaction details, including the recipient address, on the device screen rather than trusting a companion app. Users who never update device apps get no protection from any of this, which is the part both companies agree on.
Hardware wallets remain the recommended default for self-custody, and neither company claims otherwise. But the Ledger-OneKey exchange shows how much of the product is now the security response itself, not just the hardware. The bug is patched, the argument is not.