Dubai, September 5, 2026 — OneKey, a self-custodial Web3 wallet platform, announced today that its Anzen security team successfully reproduced a transaction-replacement vulnerability in Ledger’s Ethereum app during internal lab testing. Ledger has confirmed the issue was identified and patched before public disclosure, with no evidence of real-world exploitation.
SPONSORED CONTENT
This is a paid press release provided by OneKey. The statements, claims, data, and other information contained herein were supplied by the advertiser and have not been independently verified by Bitcoin.com News. Bitcoin.com News does not endorse or guarantee the accuracy, completeness, or reliability of this content. Readers should conduct their own research before taking any action based on the information presented.
OneKey Anzen Security Team Reproduces Patched Ledger Signing Flaw
SHARE
Press release
The Ledger Vulnerability and OneKey’s Lab Reproduction
According to Ledger’s security bulletin, a flaw in version 1.22.1 of the Ethereum app could allow a malicious or compromised host to send a second command while the original transaction remained on screen. In that scenario, a user could review one transaction while the device signed different parameters.
OneKey’s Anzen team used Speculos and a locally built executable to reproduce the vulnerability scenario. The team also resolved a Speculos “reset 502” issue during testing. Ledger says it added app-level protections in Ethereum app 1.22.2 on Aug. 13 and fixed the underlying issue in Ledger Secure SDK v26.6.1 on Aug. 21. The company recommends users install Ethereum app 1.22.3 or later through Ledger Live and verify the app version on their device. Updating device firmware alone is insufficient.
“Security research like this helps the entire hardware wallet ecosystem stay ahead of potential threats,” said Yishi Wang, CEO & Founder of OneKey.. “Our Anzen team’s ability to reproduce this flaw demonstrates the value of independent security testing in the Web3 space.”
About OneKey
OneKey offers a self-custodial Web3 app and compatible hardware wallets. Users can manage multichain assets, access DApps and DeFi, and trade perpetual contracts without giving OneKey control of their private keys. OneKey App functions as a software wallet or connects to compatible hardware wallets, where private keys are stored and transactions are signed.
OneKey does not hold user funds or control keys used to authorize transactions. Assets deposited into third-party protocols remain subject to those protocols’ smart contracts and associated risks. OneKey publishes open-source code for OneKey App, while hardware-wallet firmware repositories are available under open-source licenses. Third-party audits by SlowMist have reviewed OneKey Pro, Classic 1S, and the OneKey SDK.
OneKey App supports multichain asset and DApp management, third-party swap and bridge routes, batch transfers on supported networks, and address management. Its DeFi section includes Earn, Borrow, and Portfolio views for supported protocols, displaying assets, debt, rewards, net value, and health metrics. Users can deposit assets, borrow, repay, claim rewards, and exit positions through OneKey App on protocols that support these actions.
Starting with OneKey App 6.5.0, Gas Sponsorship is available for eligible token sends and centrally routed swaps on Ethereum Mainnet, Arbitrum One, BNB Smart Chain, Polygon, and Base, plus USDC deposits to Perps on Arbitrum. Eligible users can receive sponsorship for up to 10 transactions per day, subject to availability and fair-use checks.
SignGuard and Clear Signing provide risk alerts and readable transaction details before signing, though coverage is still expanding. Other security controls include suspicious-token hiding, trusted contacts, and authorization management. On iOS and Android, private-key display pages block screenshots, protect against screen recording, and blur the background.
OneKey Perps, built into OneKey App, uses Hyperliquid’s onchain infrastructure for perpetual-contract trading. Users deposit collateral into the protocol’s onchain contracts and view balances, market data, positions, and orders in OneKey’s mobile or desktop app. Depending on availability, OneKey Perps may offer contracts tied to cryptocurrencies, U.S. and global equities, precious metals, indices and ETFs, commodities, foreign exchange, and selected pre-IPO markets. Available symbols, leverage limits, liquidity, funding rates, and regional access can change; users should check the app for current markets and terms.
Users can place market and limit orders, open long or short positions, choose a margin mode, and use BBO quick orders. Before order submission, the interface displays funding rates, margin settings, fees, and estimated liquidation price. Push notifications provide trade updates but do not replace active position monitoring.
OneKey reports more than 1.2 million downloads, more than 120,000 monthly active users, and more than $8.45 billion in self-custodied assets. The app supports more than 30,000 coins and tokens.
YZi Labs led OneKey’s Series B funding round at a $150 million valuation, with earlier investors including Coinbase Ventures, Dragonfly, and Ribbit Capital.
For more information, visit OneKey App or view the OneKey Perps market list.
_________________________________________________________________________
Bitcoin.com accepts no responsibility or liability, and shall not be liable, whether directly or indirectly, for any loss, damage, claim, cost, or expense of any kind, whether actual, alleged, or consequential, arising out of or in connection with the use of, or reliance upon, any content, goods, or services referenced in this article. Any reliance placed on such information is strictly at the reader’s own risk.
