Ledger fixes Ethereum app bug after AI firm’s public disclosure, CTO calls it fear‑mongering

Ledger announced that it had already patched a vulnerability in its Ethereum application on August 12, two weeks before an AI security firm publicly disclosed the issue. The company’s chief technology officer, Charles Guillemet, described the external disclosure as fear‑mongering and criticized the firm’s handling of the matter.

What the vulnerability entailed

The flaw allowed a malicious website to send a second command to the Ledger device while the user was still reviewing the first transaction. Because the device continued listening on the Application Protocol Data Unit (APDU) channel, it could accept the second command and sign an unlimited token approval without the user’s explicit awareness. Such approvals have been linked to large‑scale phishing attacks, with Chainalysis reporting roughly $1 billion stolen through similar tactics since May 2021.

Discovery and disclosure timeline

The AI firm, TestMachine, identified the bug using its Azimuth AI agent, which scans smart‑contract code for exploits. TestMachine shared its findings with Ledger’s bounty program after the patch had already been released, and declined any reward. Ledger’s internal security team, Donjon, had detected the issue earlier with its own tools and issued the fix in version 1.22.2 of the Ethereum app on August 12. The update was noted only with a brief “Security issues” entry in the changelog, without a dedicated security bulletin.

Ledger’s response

Guillemet emphasized that the company had acted responsibly by fixing the vulnerability promptly, but criticized the external firm for publishing a thread that implied the problem remained unresolved. He called such actions “manufacturing fear for attention” and urged researchers to follow responsible disclosure practices.

Impact on users

Owners of Ledger devices—including Nano X, Nano S Plus, Stax, Apex and Flex—should ensure their Ethereum app is updated to version 1.22.2 via Ledger Live. The update resolves the APDU‑listening issue and restores the intended clear‑signing behavior.