The Ledger 'Hack' Nobody Suffered — and the Patch Log That Tells the Real Story

we hacked ledger.

That opener — one lowercase line from OneKey's founder on X, August 27 — announced that Anzen, OneKey's in-house security team, had reproduced a transaction replacement attack against Ledger's Ethereum app, version 1.22.1, in a lab. The bug as described: a race condition between the wallet's display logic and its transaction buffer, so you review a legitimate transaction on the device screen and press confirm, but the device signs a different instruction that was slipped in while you were reading. For anyone keeping crypto on a hardware wallet — or deciding whether to trust one — this is a headline built to stop the scroll. Read it slowly. The faster it goes down, the less accurate it is.

Start with the version number: 1.22.1. It matters because Ledger had already hardened that app. On August 13 it released Ethereum app 1.22.2 with application-level checks that close exactly this path, and on August 21 it shipped the underlying correction in the Secure SDK, version 26.6.1. Ledger's reply to OneKey was blunt: reproducing a bug in an outdated, already-fixed build is "a lab exercise, not a finding." Its security team insisted no user was hacked, with no evidence of exploitation in the wild. On the narrow question — was Ledger hacked? — the evidence backs Ledger. Demonstrating a flaw in a version published before the patch is how you dramatize a stale bug, not how you breach a company. OneKey itself did not claim otherwise; it said only that the window had existed and that Ledger shipped the fix quietly.

Then OneKey's own spotlight pulled something out of Ledger's paperwork that the denials did not volunteer. The update Ledger holds up as its fix, 1.22.2, was itself incomplete; two other signing flaws were still inside it. One, an array-count overflow, let a batch of 257 operations wrap a counter so the device displays only the last operation while the signature covers all of them. The other sat in the swap path of Ledger's Exchange app: it verified token, amount and destination but not that the requested action was actually a payment, so a compromised swap provider could substitute a token approval without an extra device prompt. According to the disclosure trail, fixes for both were merged into Ledger's codebase in May. They did not reach users until August 25, in version 1.22.3, and Ledger disclosed the two bugs on August 27 — the same day it was publicly waving off OneKey. None of the three flaws was exploited; no user lost funds. Nor are the extra two easy to trigger: one calls for a contrived, attacker-controlled batch of 257 operations, the other for a hostile swap provider. So this is not a story of funds at risk; it is a story of process. In two weeks, the company that markets itself as the safest place for your keys shipped a fix, then a fix for the fix, while two known signing flaws sat in its code for roughly a quarter. It costs nothing to imagine the ordinary reasons — internal testing, release trains, store review. That is the point. For a product sold on the promise that nothing ships until it is perfect, the ordinary cadence is the vulnerability.

Both companies are in the same business, and it is not making hardware. Hardware wallets are low-margin boxes in a market analysts put at roughly $700 million a year today, growing about a quarter annually — a rounding error beside the value they guard. The economics live in the installed base and in the relationship after the sale: companion software, swaps, staking, recovery, the institutional business. Security is the product, and the narrative around it is the marketing budget. OneKey, the challenger founded in 2019, raised a Series B last year at a $150 million valuation led by YZi Labs, the former Binance Labs — and it runs Anzen deliberately, a lab built to test and break hardware wallets for research. You do not outsell a leader that claims seven million devices and a fifth of the world's crypto; you outmaneuver it in the press room, reproducing a flaw, framing it as a hack, publishing the postmortem. Weeks earlier Anzen ran the same formula against Coldcard, though that was a genuinely different story — a theft of more than $100 million in bitcoin through a predictable-randomness flaw, exploitation in the wild rather than a lab. Research that markets is a distribution channel, and it is working.

Ledger's rebuttals are the same game played downhill. Its CTO had already called an earlier public disclosure of this identical bug "fear-mongering," and its dismissal of OneKey was polished to protect the premium. The premium is the entire point. In February, press reports said Ledger had brought in Goldman Sachs, Jefferies and Barclays to explore a U.S. listing that could value it above $4 billion; by May it had shelved the plan as the crypto IPO window shut. None of this reduces the business by itself — no funds lost, no users harmed — but for a company whose asset is trust, reputation is a balance-sheet line. The only genuinely valuation-relevant news in this dispute is the patch log: a fix written months before it shipped, two more released late, an emergency update that was itself incomplete. That is a process gap, and process gaps are what eventually cost a trust product its premium.

Now the part that is useful to a person actually storing crypto. Every condition in this affair — the stale bug OneKey demonstrated, the two that shipped late — required an attacker already controlling the connection between your device and the network: malware on the computer, a cloned wallet app, a hostile browser page. A hardware wallet protects what it shows you; it cannot protect you from what the host hides. And in every one of these cases, the control that mattered was mundane: updating the application on the device. Ledger's own bulletin is explicit that a firmware update alone does not replace an outdated app; users must install the current Ethereum app through Ledger Live. The difference between running the vulnerable version and running the fixed one was never a brand choice. It was an update routine.

So read the next "we hacked [vendor]" headline as an ad, and read the incumbent's denial as a defense of its margin. Both are true, and both are beside the point: the version number on your device is the fact that settles your exposure. As investment signal, the useful message is about where value sits in the stack. Hardware is commoditizing. Research is the weapon. The durable moat is a fast and honest patching operation wrapped around an installed base that actually updates. This week gave clean evidence of how much that moat matters — and equally clean evidence that the category's leader has not yet locked it down.