OneKey Reproduces Transaction Replacement Exploit on Outdated Ledger Ethereum App

How the Transaction Replacement Exploit Functions in Legacy Environments

On August 28, 2026, OneKey announced it successfully reproduced a transaction replacement attack targeting an older version of the Ledger Ethereum application in a controlled laboratory setting. The exploit, which manipulates pending transactions to replace them with malicious alternatives, was demonstrated against legacy software no longer receiving security updates. OneKey emphasized that the vulnerability does not affect current versions of the Ledger app and was identified solely for research purposes.

The attack leverages a flaw in how certain outdated Ethereum apps handle transaction nonces and gas pricing, allowing an attacker to submit a higher-fee transaction that overrides a legitimate one before confirmation. OneKey’s security team replicated the scenario using modified network conditions and deprecated app builds to verify the exploit’s feasibility. They noted that while the attack requires specific preconditions—such as user interaction with a compromised interface or man-in-the-middle positioning—it underscores risks associated with using unsupported cryptocurrency wallet software.

What Steps Should Users Take to Mitigate Similar Risks?

The exploit hinges on the ability to broadcast a replacement transaction with identical nonce but elevated gas price, effectively outbidding the original in the mempool. In the tested Ledger Ethereum app version, insufficient validation of transaction sequencing allowed this maneuver to succeed when users attempted to cancel or speed up transactions. OneKey researchers observed that the flaw only manifests when the app fails to properly lock nonce values during user-initiated transaction edits, a safeguard present in newer releases. They stressed that modern Ledger devices running updated firmware remain protected due to enhanced transaction validation protocols.

Users are advised to ensure their Ledger Live application and device firmware are updated to the latest versions, as patches addressing such nonce-related vulnerabilities have been deployed in recent releases. OneKey recommends avoiding third-party interfaces that interact with outdated wallet software and verifying transaction details directly on the device screen before confirmation. The company also urged wallet providers to maintain clear end-of-life policies for older apps and to communicate upgrade requirements transparently to prevent exposure to known exploits.

Is my Ledger device at risk if I use the current version of the Ethereum app? No, the reproduced exploit targets only outdated versions of the Ledger Ethereum app; current releases include fixes that prevent transaction replacement attacks under normal conditions.

Frequently Asked Questions

Can this attack be executed remotely without user interaction? The exploit requires specific conditions, including potential user engagement with a compromised transaction interface or network-level manipulation, making remote, silent exploitation unlikely in practice.

How can I confirm my Ledger app is up to date? Users should open Ledger Live, navigate to the Manager section, and check for available updates to both the application and device firmware, installing any pending patches immediately.