OneKey Reproduces Transaction-Replacement Attack in Older Ledger Ethereum App

OneKey, a hardware wallet maker, said it reproduced a vulnerability in an older version of Ledger’s Ethereum app that could allow an attacker to replace a transaction a user intended to sign with a different one. The flaw has since been fixed.

Cointelegraph reported on August 28 that OneKey’s security team successfully reproduced a “Transaction Replacement Attack” in a test environment using version 1.22.1 of Ledger’s Ethereum app.

In such an attack, a malicious actor swaps out a pending transaction while the user is reviewing what appears to be legitimate transaction details on the hardware wallet screen. That means the transaction the user initially verifies may differ from the one ultimately signed, creating a risk that assets could be sent to an address designated by the attacker.

Ledger released version 1.22.2 of its Ethereum app on August 13, adding app-level protections. It then fixed the underlying issue on August 21 through Secure SDK 26.6.1.

“No Ledger users were hacked,” Ledger said, adding that the case involved a vulnerability in an older version of the Ethereum app that was reproduced in a laboratory environment.