Ledger announced on August 23 that a vulnerability in the clear signing flow of its Ethereum application had been patched prior to public disclosure by TestMachine, a security research firm. The issue involved Application Protocol Data Unit communication between the Ledger Ethereum app and connected applications, allowing a malicious app to submit an alternate transaction while a user reviewed the displayed transaction on the device. Charles Guillemet, chief technology officer of Ledger, said the firmware and application update deployed about two weeks earlier protects users. He added that no confirmed thefts related to the flaw have been reported as of August 24. TestMachine disclosed the finding after conducting an autonomous scan on a Ledger Flex device and said the vulnerability existed in certain clear signing flows across Nano X, Nano S Plus, Stax, and Apex models. The company warned that an attacker could replace transaction data, potentially causing a user to approve a broader token approval than intended. Ledger disputed the timeline, stating that TestMachine contacted its bounty program after the fix was already shipped and that the researchers did not coordinate with the bounty team before publishing. Guillemet said claims that the issue remained active were intended to generate attention. Ledger’s repository shows several security-related changes in August, but the specific patch corresponding to the reported clear signing bug has not been clearly identified. Users are advised to update device firmware, the Ledger Wallet software, and the Ethereum application, and to verify transaction details directly on the device screen. The incident follows a separate Zilliqa signing flaw disclosed earlier, which exposed private keys for recorded signatures.