Ledger patches Ethereum app bug that could show one transaction and sign another

What went wrong (in plain-ish English)

Ledger fixed a sneaky bug in its Ethereum app where the device could show you one transaction on the screen but secretly sign something else. The trick required a connected web app with low-level access (think WebHID). That app could slip in a second signing command while you were still reviewing the first one. You’d see the original transaction on your device, hit approve, and the device could end up signing the swapped-in data instead.

On the technical side, the problem came from two weak spots: the app would accept a new signing command during an active review, and approval callbacks could proceed even if the app’s internal state had changed. In short — the device’s memory could be updated behind the scenes while the screen showed old information.

Scope, fix, and what to do

Ledger released Ethereum app version 1.22.2 to close this hole. The patch makes the app refuse new signing sessions while a review is active and rejects approval callbacks when the app’s state no longer matches expectations. The fix was applied to the code base used for several Ledger models, so the affected list includes Flex, Nano X, Nano S Plus, Stax, and Apex.

Practical checklist for users: update the Ethereum app to version 1.22.2 as soon as you can; keep your device firmware and client software up to date; and only connect to dApps you trust. There are no confirmed reports of this bug being used in the wild, no reported fund losses, and no signs of private key leaks so far — but updating removes the risk.

Timeline notes: the patched app version appears in the project history and was tagged around mid-August. A security researcher group publicly described the issue afterward, and Ledger’s internal security team also reported finding and fixing the bug around the same time.