Hardware wallets are built around a simple security promise:
What you see on the secure screen is what you sign.
A vulnerability disclosed by Ledger on August 27 shows why maintaining that boundary is technically difficult.
Ledger's security team published details of a vulnerability affecting Ethereum App versions 1.19.0 through 1.22.2.
In a specially crafted batch transaction, the Ledger device could display only one operation for review while the resulting signature authorized many more.
The issue is fixed in Ethereum App version 1.22.3.
Ledger says it has no evidence that the vulnerability was exploited against users.
What happened?
The issue involved how Ledger's Ethereum App handled arrays inside structured transaction data.
A transaction could contain a list of 257 operations.
Internally, one component stored that count using a value capable of representing 257.
But another component used a smaller field.
The number effectively truncated.
The device therefore believed it had only one item left to display.
The user saw one operation.
The cryptographic signature still authorized the entire batch.
Ledger described the problem as an array-count truncation flaw.
Why this matters
The cryptography itself did not fail.
The private key was not extracted.
The Secure Element was not cracked.
Instead, the interface between:
what the user reviewed
and
what the signature authorized
became inconsistent.
That is exactly the class of problem clear signing is supposed to prevent.
What is clear signing?
Smart-contract transactions can be difficult for humans to interpret.
Instead of showing raw hexadecimal data, clear signing attempts to translate a transaction into understandable information.
For example:
Send 1 ETH to address X.
The user then confirms those details on the hardware wallet itself.
This matters because the computer or phone connected to the wallet may be compromised.
The device screen is supposed to provide an independent source of truth.
What the proof of concept demonstrated
Ledger says the vulnerability was reproduced end to end in a controlled environment.
An affected device generated an EIP-712 signature authorizing a batch of 257 operations after only displaying one.
The resulting batch was then executed on a private fork.
The receipt contained 256 operations that had not been displayed to the user.
That demonstrates real exploitability.
But there are equally important caveats.
Ledger says:
- no production frontend was compromised;
- no public-network transaction was broadcast;
- no real user funds were moved.
Those distinctions matter.
Which versions are affected?
Ledger identifies Ethereum App versions:
1.19.0 through 1.22.2
as affected.
The fix is included in:
Ethereum App 1.22.3 or later.
Users should update the Ethereum application through Ledger's official software and verify the installed app version on their signing device.
Updating only the device firmware is not necessarily enough because the vulnerability sits in the Ethereum application.
Why 1.22.2 deserves special attention
Ledger's disclosure timeline shows the original report was submitted in March.
A fix was developed in April.
However, Ethereum App version 1.22.2 was tagged on August 13 without the correction.
The researcher then notified Ledger that the fix was absent.
Ledger released 1.22.3 on August 25 with the corrected code.
That timeline is worth examining because vulnerability remediation is not only about writing a patch.
It is also about ensuring that the corrected build reaches users.
Another issue was fixed at the same time
Ledger also disclosed a second Ethereum App problem involving swap transactions.
In that case, a token approval could potentially satisfy validation checks intended for an actual token payment.
The result could authorize spending permission instead of the transfer the user believed they were confirming.
Ledger says this issue was also fixed in 1.22.3 and that there is no evidence it was exploited.
Together, the disclosures reinforce one theme:
transaction interpretation is becoming one of the most important attack surfaces in crypto custody.
Why hardware wallets are still useful
It would be wrong to conclude that hardware wallets therefore offer no security advantage.
They still protect private keys from many classes of malware and remote compromise.
But a hardware wallet cannot protect the user if the device itself incorrectly interprets what it is authorizing.
Security therefore has several layers:
private-key protection
*
transaction parsing
*
clear signing
*
user review.
Any layer can matter.
Risks and limitations
Ledger says the disclosed vulnerability required specific transaction structures.
There is no confirmed evidence of in-the-wild exploitation.
Users should therefore avoid treating the disclosure as evidence that Ledger wallets were broadly drained.
At the same time, a high-severity signing-interpretation flaw should not be minimized merely because researchers discovered it before attackers.
Updating is appropriate.
What users should do now
The practical actions are simple:
- update the Ledger Ethereum App to 1.22.3 or newer;
- confirm the app version directly on the device;
- use official Ledger software;
- continue reviewing transaction details before approval;
- avoid blind signing wherever possible.
What to watch next
The larger issue is how hardware-wallet vendors handle increasingly complicated smart-contract activity.
Transactions now involve:
- account abstraction;
- batch calls;
- bridges;
- swaps;
- permits;
- multisig;
- DeFi interactions.
The more complex transactions become, the harder it is to convert code into a truthful human-readable screen.
That may become the central hardware-wallet security problem of the next several years.
The lesson from this incident is therefore broader than one patched bug:
Protecting a private key is only useful if the signer also understands exactly what that key is authorizing.
FAQ
Was Ledger hacked?
Ledger disclosed an Ethereum App vulnerability found through security research. There is no evidence that Ledger's infrastructure was broadly hacked or that the disclosed flaw caused real user losses.
Which Ledger Ethereum App versions are affected?
Versions 1.19.0 through 1.22.2.
Which version fixes the vulnerability?
Ethereum App 1.22.3 or later.
Were funds stolen?
Ledger reports no evidence that the disclosed vulnerability was exploited against real users.