Critical vulnerability discovered in Ethereum app on Ledger wallets

A critical security vulnerability in Ledger's Ethereum app has been disclosed, which could have enabled malicious decentralized applications (DApps) to drain users' crypto wallets in a single transaction. The design flaw permitted attackers to secretly swap a standard transfer into an unlimited token approval, providing backdoor access to all ERC-20 tokens stored on the hardware wallet. The flaw was initially uncovered by Ledger's internal Donjon security team using AI-powered detection tools and independently disclosed by security research group TestMachine. Ledger quietly patched the issue on August 12 with version 1.22.2 of the Ethereum app. While company officials confirmed no active exploits have been detected to date, users who have not updated remain vulnerable. This incident follows other recent security challenges for Ledger, including a Zilliqa app flaw that led to the theft of 683 million ZIL tokens and a vendor-related customer data breach. Ledger strongly urges all hardware wallet users to update their device applications immediately to safeguard their holdings.