'We Hacked Ledger': What the Claim Really Was, and the Version Check That Clears You Tonight

we hacked ledger.

That is the post OneKey's CEO Yishi Wang published on August 27, and it was engineered to land: a rival hardware-wallet maker claiming a direct hit on the industry's most trusted brand. The claim behind the headline is narrower than it reads, and the version of Ledger's Ethereum app on your device decides whether any of it touches you. Set the tape first. This is one round of a security-marketing war between wallet brands that are private companies, whose real currency is trust — playing out in a crypto tape that is warm but not euphoric: bitcoin near $77,600, about 38% below its 52-week high, total market cap near $2.6 trillion, the greed gauge at 68. No ticker moves on this story. Your holdings do.

What OneKey's security team says it did

OneKey's in-house security team, Anzen, said it reproduced a "transaction replacement" attack against Ledger's Ethereum application — version 1.22.1, an outdated build — in a laboratory. The mechanism sounds like the worst-case wallet story: you review transaction A on the device's own screen, and the chip signs transaction B, so you approve a normal transfer and the coins go to an address you never saw. No private key is extracted and no recovery phrase is touched. The bug does not do what "we hacked Ledger" implies, and it cannot run against a current device.

A hardware wallet is a single promise, called the trusted-display guarantee: what you confirm on the device's small screen is exactly what its secure chip signs, and the chip never hands the key to the computer it is plugged into. Ledger tracked this flaw as LSB-023, a race condition that broke that guarantee at one seam. The signing parameters wait in shared memory while you read the screen; a second command arriving mid-review can overwrite that memory without the display refreshing — a time-of-check to time-of-use class flaw that Ledger says was introduced in August 2025 and affected the Ethereum app through 1.22.1 and the underlying Secure SDK through 26.6.0. The boundary that matters more: an attacker must already control the link between your device and its host — malware, a compromised wallet program, or a malicious webpage using the browser's WebHID or WebUSB access to talk to the hardware directly — and you still have to press approve. This is a redirect, not a key theft, and it cannot drain a wallet sitting unplugged in a drawer.

The timeline is the fact

The interesting part is the calendar, not the tweet. Ledger's internal security team says it found the flaw and had a fix ready about two weeks before anyone outside the company heard of it: the app-level patch shipped as Ethereum app 1.22.2 on August 13, with a defense-in-depth layer in the Secure SDK (26.6.1) on August 21. An outside firm named TestMachine then published the same race condition in late August, after the fix was live, and Ledger's CTO publicly pushed back — reproducing an already-patched bug, in his words, is not the same as "hacking Ledger."

And here the version history does something worth a slow read. On August 25 — two days before OneKey's post — Ledger shipped 1.22.3, fixing two signing flaws that 1.22.2 had not covered, catalogued as LSB-024 and LSB-025. LSB-024 was an arithmetic slip: the app read the number of operations in a clear-signed batch with a 16-bit counter but stored the remainder in 8 bits, so a batch of 257 operations wrapped the count back to one — the screen displayed only the last operation while the signature authorized the whole array. LSB-025 sat in Ledger's swap-exchange path: the app checked the token, quantity, and destination but never verified that the requested action was a payment, so a malicious swap provider could substitute a token approval and have it signed without an extra device prompt. Ledger's own notes show both sets of fixes had been merged into the codebase months before 1.22.2 shipped, without an explanation of why they missed that release. Ledger says none of the three flaws was exploited and no user lost funds.

Two readings, one separator

Both readings of this story are, so far, true. Reading one: Ledger shipped three signing fixes across two releases in twelve days and spent a month in disclosure disputes — a bumpy handling of a real flaw family. Reading two: nothing was exploited, no user funds were lost, and Ledger's own position holds that no user was hacked — every demonstration was a lab run against an already-replaced app version. The data point that separates the readings is not in the thread; it is the Ethereum app version installed on your device right now. Below 1.22.3, part of that list applies to you. On 1.22.3 or later, this round is a spectator story about private companies arguing.

Why your money should care

Businesses, like bugs, live at boundaries. A hardware wallet moves the security boundary; it does not remove it. The key stays welded inside a certified chip, and everything around it — the marketing database, the browser, the signing layer, the swap integration — remains a trust problem with a logo on it. Ledger has demonstrated the pattern for six years. In 2020 its e-commerce database was breached, exposing more than a million customer contact records that fed phishing campaigns for years. In December 2023, malicious code slipped into its Connect Kit library and drained around half a million dollars from users of apps built on it — the breach ran through an npm package, not through any chip. In January 2026, customer order data leaked through a third-party cloud vendor. Each time, "your keys are safe" was technically true and nearly beside the point of the damage.

That matters to an investor because trust is the entire balance sheet of the hardware-wallet business, and trust is precisely what a rival is now publicly stress-testing for market share. Reports this year said Ledger — privately valued around $1.4 billion in 2023 — was weighing a U.S. listing at a reported $4 billion target and had sounded out Goldman Sachs, Jefferies, and Barclays. The company put those plans on hold in May, citing market conditions; this story came later, so it is not the IPO killer, only another line on the risk that will eventually price that story. Keep the stakes in scale: the entire hardware-wallet market clears a few hundred million dollars a year in revenue, a niche growing at a forecast pace of roughly a quarter per year. This is a debate about the margin of trust inside a small but fast-growing industry.

The event that actually rewrites the sector's math is the one Ledger says has not happened to it: a real fund loss tied to current hardware. The industry got a live demonstration this July, when attackers swept roughly $38 million — about 594 bitcoin — from around 500 wallets in 25 minutes through a Coldcard entropy bug, a failure in the firmware's randomness handling, software-side rather than in the certified chip. Nothing in the OneKey–Ledger exchange comes close to that. That is the difference between a lab replay and a funds event, and it is the difference between noise and risk.

Tonight, in five steps

Nothing here requires an opinion. It requires a screen.

1. Open Ledger Live and read the Ethereum app version. It should read 1.22.3 or higher.
2. Understand that the fix is on the device, not on your phone or desktop. Updating Ledger Live or the device firmware does not move the app version; the app itself must be updated. The exit is written before the entry: version ≥ 1.22.3.
3. Treat WebHID and WebUSB as your real attack surface. Sign from web pages you control, verify the recipient address on the device display — the physical screen, not the app window — before approving, and treat any dApp that "shows" you a transaction you cannot read on-device as a blind-signing risk.
4. Layer custody so the layer that can be tricked is the layer you can afford to lose: the bulk of the position in cold storage, this month's spend in a hot wallet.
5. When the next "hacked" headline lands, run three filters in one sitting: did real funds move, was current-version hardware involved, and did the fix ship before the disclosure? Three no's are a watchlist item, not an action. A yes to the first is an action, and retweets come after.

This checklist has an expiry, like every playbook. It stays correct only while Ledger's flaws keep landing in the signing layer of outdated apps. It stops being sufficient the day a disclosed flaw is proven against current hardware with coins actually moving — the Coldcard shape of risk, not the OneKey shape. That is the regime change that retires "update and carry on" and leaves the honest question standing: a hardware wallet keeps the key inside the chip, and it does not protect the link, the browser, or your attention. Every layer you hold has a border. Know which side your coins are on.