Ledger Rushes Out Fix After Researchers Expose Signing Flaw In Popular Crypto Wallets

A security gap in Ledger's Ethereum application allowed a connected app to swap out transaction details while a user was still reviewing them on screen, according to findings from security firm TestMachine.

The company has since released version 1.22.2 of the app, urging users to update immediately.

What Went Wrong Inside The Signing Process

The flaw centred on a feature called clear signing, which is designed to let Ledger users see exactly what they are approving, whether that's an amount, a wallet address, or a smart contract action, all displayed in plain, readable text on the device.

The idea is simple: no one should have to approve a transaction based on a string of code they can't understand.

TestMachine says its research tool, named Azimuth, uncovered a way to get around that protection.

According to the firm, a malicious app with WebHID access could send a second signing command while the original transaction was still being displayed for review.

That second command could quietly replace the transaction sitting in the device's memory, without triggering a new review screen.

The result: the screen would keep showing the first transaction while the device actually signed something else entirely.

TestMachine pointed to one scenario where a small, low-risk transaction was swapped for a much broader token approval, all while the user believed they were confirming something minor.

Which Devices Were Affected

TestMachine says it validated the exploit on a Ledger Flex device, but claims the underlying code is shared across other models too, including the Nano X, Nano S Plus, Stax, and Apex.

The tagged app manifest for the fix lists all of these devices as build targets, lending some support to that claim.

That said, a full public demonstration showing funds actually stolen across every named device had not surfaced at the time of publication.

How Ledger Says It Caught The Bug First

Ledger insists it had already found and patched the issue internally before TestMachine went public.

Chief Technology Officer Charles Guillemet announced the update on 23 August 2026, saying the company's internal security team, Ledger Donjon, discovered the bug using an artificial intelligence research tool.

He said the fix had shipped roughly two weeks before his public statement.

Guillemet also pushed back on how TestMachine handled disclosure.

He said the researchers only contacted Ledger's bounty programme after the fix was already live, and that they went public with claims suggesting the flaw was still active without first checking with Ledger's bounty team.

He described this as manufacturing fear for attention.

TestMachine, for its part, maintains it shared and verified its findings with Ledger, though it turned down a bounty payment.

The two sides have not agreed on the actual sequence of events.

What The Code Changes Actually Fixed

A look at Ledger's public code history shows two specific fixes tied to this issue.

One commit addressed the problem of new signing commands being able to tear down an active review before returning an error.

Another added state checks, since approval callbacks had previously been able to sign a transaction without first confirming the app was still in the expected signing state.

Version 1.22.2 closes both of these paths.

It now blocks a new signing session from starting while a review is already active, and it rejects any approval callback if the device's state no longer matches what it should be.

Ledger has not, however, published a full technical breakdown or a list of exactly which versions were affected.

Why This Is Different From Past Ledger Security Issues

This case is separate from an earlier flaw involving Zilliqa's Ledger app, which exposed users' private keys directly.

That issue was far more severe in one respect: it could not be fixed retroactively for any keys already exposed through past signatures.

The clear signing bug, by contrast, appears to be resolved through the software fix itself, without any indication that user funds or keys were compromised as a result.

What Ledger Users Should Do Right Now

Ledger is advising users to update three things together: the Ledger Wallet software, the device firmware, and the Ethereum app itself.

Updating only the desktop or mobile software, without also updating the app running on the physical device, may not be enough to close the gap.

Beyond updating, Ledger is reminding users to always check transaction details directly on the device screen before hitting approve, rather than relying solely on what appears on a connected computer or phone.

The company also flagged that blind signing, approving a transaction without full readable detail, remains inherently risky, since not every smart contract interaction can be displayed in plain text.

As of 24 August 2026, Ledger has not announced any compensation scheme or fund recovery process connected to this bug, nor has it issued a formal advisory naming the exact range of affected versions.