A transaction replacement attack. A quiet fix. A CTO calling it fear-mongering. The code didn’t lie, but the disclosure process did.
On August 2026, TestMachine, an AI security firm, published a public report detailing a critical vulnerability in Ledger's Ethereum application. The bug: a malicious website could replace a transaction on the user's hardware wallet screen while the user reviewed the first transaction. The attack vector was the APDU channel—the communication protocol between the browser and the device. In plain English: you see a small transfer, you sign what looks like a harmless approval, but the device actually signs an infinite token approval to a stranger. The wallet screen shows the attacker's transaction, not the one you intended.
Tracing the bleed through the gateway. The vulnerability affected Ledger Nano X, Nano S Plus, Stax, and Apex—essentially all major Ledger devices. They share the same APDU/UI code. The fix was pushed in version 1.22.2 with a single-line commit message: "Security issues." No security advisory. No CVE. No public acknowledgment until TestMachine forced the issue into the open.
Ledger's CTO, Charles Guillemet, responded by calling TestMachine's disclosure "fear-mongering." He claimed Ledger's internal Donjon team had already identified the bug and fixed it. But the timeline matters. TestMachine shared their findings with Ledger, confirmed the vulnerability, and then published after Ledger had issued the patch. Ledger's complaint? TestMachine should have waited longer, or coordinated more. But history is a Merkle tree, not a narrative. The patch was already live. The users were protected. The only thing missing was transparency.
Let me pull from my own experience. In 2017, I audited TheDAO's smart contract and identified the recursive call vulnerability. I submitted a detailed report to core developers. They ignored it. The $60 million hack followed. The lesson: silence is not a security measure. It's a deferred cost. When Ledger buries a fix in a single line, they are not protecting users. They are protecting their brand narrative. The real vulnerability here is not the APDU channel—it's the trust channel.
The Core Technical Breakdown
The attack exploits the asynchronous nature of the APDU protocol. The browser sends a command to the Ledger device to display transaction A. While the user reads transaction A on the screen, the browser sends a second command to replace it with transaction B. The device, because it listens for new commands during the user's review period, accepts the replacement. The user sees the original transaction, but the device signs the replacement. This is not a hardware flaw. It is a design flaw in the interaction flow between the UI and the APDU handler.
TestMachine's AI agent, Azimuth, discovered this bug by scanning smart contracts and device firmware. On the EVMBench benchmark, Azimuth captured 86.3% of known vulnerabilities with a 2.7% false positive rate. But these numbers are self-reported. No independent audit. The AI is good at finding known patterns. What about zero-day? The Ledger bug itself was not a zero-day—it had been present for years. Azimuth found it because it was a known pattern. The AI didn't invent new attack vectors. It automated the search.
Verify the root, ignore the branch. The root cause is the APDU channel design. The branch is the disclosure controversy. Fixing the branch without addressing the root is like patching a leak without replacing the pipe. Ledger's fix blocks the replacement command during the user review window. That is a band-aid. The real question: why did the APDU protocol allow a second command to override a pending transaction in the first place? The answer is in the code. The code didn’t anticipate adversarial browsing sessions. The assumption was that the browser would behave honestly. That assumption is now broken.
The Contrarian Angle
What did the bulls get right? Ledger's internal Donjon team did find the bug first. They fixed it. They pushed the update to millions of devices. From a security engineering perspective, that is competent. The patch is effective. The window of exploitation was narrow—only users who visited a malicious site while running an unpatched version were at risk. No actual drain has been reported. So why the outrage?
Because the trust cost is real. Users who bought Ledger for "clear signing"—the promise that the device screen shows exactly what you sign—now know that promise has a technical loophole. The device screen can be tricked. That is not a hypothetical. It is a proven exploit. And the silence around the fix makes it worse. If Ledger had published a detailed advisory, users would have understood the risk and the mitigation. Instead, they found out through a third party's public report. Precision is the only apology the truth accepts. Ledger's response was not precise. It was defensive.
The Takeaway
This is not a story about AI versus humans. It is a story about the gap between discovery and disclosure. AI tools like Azimuth will find more bugs faster. The question is whether the industry can handle the speed of that discovery. Ledger's CTO called the disclosure fear-mongering. But the real fear is not the bug. It's the culture of silent fixes. When the code is fixed but the narrative is hidden, the system is not secure. It's just quiet.
Entropy always finds the path of least resistance. Ledger's silent fix was the path of least resistance for the company. But for the user, the path of least resistance is trust. That trust is now a single line of code away from being broken again. History will not remember the fix. It will remember the silence.