Ledger Ethereum app signing flaw quietly patched on August 12, users urged to update

A silent fix meets loud disclosure on August 24

Wallet vendor Ledger publicly acknowledged on August 24, 2026 that it had patched a flaw in the Ethereum app on its hardware wallets roughly two weeks earlier, without publishing a security advisory. The bug sat in certain clear signing flows, the on-device prompts meant to show users the human-readable meaning of what they are about to sign. A malicious dApp could substitute the transaction the user ultimately approved, turning a legible preview into a meaningless screen and an attacker-controlled payload.

The patch was deployed on August 12, but the existence of the flaw became public only after outside disclosure on August 23, prompting Ledger's chief technology officer to call the surrounding chatter FUD and to ask users to update their Ledger Live firmware and the Ethereum app. The conflict between the third-party disclosure and the vendor's response has framed the rest of the day's coverage, with multiple outlets confirming both the patch date and the call to update.

The technical shape of the flaw

The vulnerability was a race condition inside the clear signing process. During the window between the device showing the user one transaction and the cryptographic signature being applied, a malicious dApp could swap the underlying payload. Because the displayed information and the bytes actually signed live in different code paths, the user sees an honest-looking approval while signing something else entirely.

The defect centered on an APDU, the application protocol data unit that carries commands between a host computer and a Ledger device. The race lived in the Ethereum app's handling of those commands rather than in Ledger's general-purpose signing primitives, which means hardware keys themselves were not exposed. The compromised piece was the layer that decides what the screen shows you about the transaction you are approving.

Why the disclosure timeline matters

Two patterns sit side by side in this episode. First, the fix landed on August 12 with a single-line changelog entry and no CVE-style notice, so anyone running the affected version only learned something was wrong after outside researchers surfaced it on August 23. Second, the third-party disclosure led with a high-impact framing while the vendor characterized it as fear-mongering, which is exactly the friction clear signing is meant to prevent.

For practitioners, the operational lesson is that "the patch shipped" is not the same as "users are safe." A two-week gap between a silent fix and a public explanation is long enough that any user who signed an Ethereum transaction through clear signing during that window should treat the signing history as needing review, and should confirm they are on a patched Ethereum app build before the next signing operation.

What practitioners should change now

The vendor's own instruction is concrete and unchanged: update Ledger Live firmware and update the Ethereum app on each device. Beyond that, teams that operate treasury or signing workflows on Ledger hardware should re-check any Ethereum transaction approved through clear signing in the roughly two-week window between the patch date and the public disclosure on August 23. Comparisons against the originally requested calldata and destination addresses, not just the on-device labels, are the way to detect any substitution.

Operations teams that rely on clear signing as their primary defense against transaction substitution should treat this as a reminder to keep a parallel off-device verification path for high-value transactions. Hashing the raw signed payload and comparing it against an independently reconstructed transaction is straightforward with a local SHA256 Hash Generator or Sha512 Hash Generator and adds a layer that does not trust the device's display alone.

What to keep watching

The vendor has stated the fix is in place and has not announced any follow-up advisory, but it has also not published the technical details of the race or the APDU handling that triggered it. The next signal worth watching is whether Ledger publishes a post-mortem with build numbers and a clearer disclosure timeline, or whether the silence continues and the only durable record of the bug lives in the third-party disclosure. Until one of those happens, the practical workflow is unchanged: patched app, reviewed signing history, and an off-device hash check on any value-moving Ethereum transaction.