By Chris Thomas | Crypto Security Audit Partner
Hook: The Disclosure That Wasn't
On August 14, 2026, TestMachine—an AI security firm most institutional investors had never heard of—published a disclosure that sent a specific kind of chill through the hardware wallet ecosystem. The company's AI agent, Azimuth, had discovered a transaction replacement vulnerability in Ledger's Ethereum application. Not in a hypothetical scenario. Not under idealized lab conditions. In the actual APDU communication channel between browser and hardware device.
The kicker? Ledger's CTO, Charles Guillemet, publicly responded by calling TestMachine's disclosure "fear-mongering"—while admitting the fix had been quietly shipped in version 1.22.2.
The ledger does not lie, only the interpreters do. And in this case, the interpretation gap is where the real vulnerability lives.
Context: The Trust Architecture Under Examination
Ledger has sold over 7 million hardware wallets. In a market where the entire value proposition rests on the phrase "secure your assets," this is not a trivial number. It represents a substantial share of the cold storage market, roughly 60% by most estimates. Trezor holds approximately 20%. The remaining players fight over the leftovers.
The architecture of trust is straightforward: the device screen displays a "clear signing" prompt. Users see what they approve. The security assumption is that the device's display is a trusted oracle—that what you see is what you sign. This is the foundation of hardware wallet security.
The flaw discovered by TestMachine's Azimuth, and reportedly independently identified by Ledger's own Donjon team, breaks this foundational assumption.
The mechanics are deceptively simple: A malicious website could send a second command to the device while the user is still reviewing the first transaction. The APDU channel—the communication protocol between browser and hardware—remains open and listening during the review process. The user sees a small transfer, but what is actually signed is an unlimited token approval to a stranger's address.
Let me be precise about the impact surface: The affected code exists across the Nano X, Nano S Plus, Stax, and Apex devices. These share the same APDU/UI implementation. In other words, the attack surface was not a niche product line. This was the mainstream hardware wallet, across the board.
Core: The Anatomy of a Silent Patch
This is where my forensic instincts sharpen. The vulnerability itself—while serious—is less interesting to me than the disclosure process that followed.
Here's what we know from the available data:
- The vulnerability was a transaction replacement attack.
- The attack requires the user to visit a malicious website and actively approve a transaction.
- The fix was shipped in version 1.22.2.
- The patch description reads: "Security issues."
- No security advisory was published.
- No CVE was assigned.
- TestMachine claims it alerted Ledger, received a response, and verified the fix before going public.
The ledger does not lie, only the interpreters do. But when the interpreter—in this case, the official patch note—says only "Security issues," we are left with a different problem: opacity as a policy.
Code is law; intent is irrelevant. In security research, the data points must be documented, verifiable, and transparent. When a patch description is as vague as this, it raises a fundamental question: Was the fix simply a defense against a specific attack vector, or was it a structural change to how the APDU channel handles concurrent commands?
Based on my audit experience with hardware wallet implementations, I have seen a pattern that recurs with alarming frequency: a security team finds a vulnerability, patches the specific exploit path, but does not address the underlying architectural weakness. The exact check that was missing—the one that allowed a second command to be processed during the review window—may or may not be a symptom of a deeper issue.
This is not speculation, but a risk assessment. The missing data point is whether the APDU channel now enforces a "one command at a time" state machine, or whether it simply filters for known malicious patterns.
The test case is the EVMBench benchmark, where Azimuth claims to have caught 86.3% of known vulnerabilities with a 2.7% false positive rate. This is a self-reported metric, and I would not recommend relying on it without independent verification. But even if we discount it by half, it suggests that AI-driven security analysis has moved beyond the theoretical.
The actual function of the AI agent in this case, whether it was a supplementary tool or a primary scanner, is less important than the fact that it found a real vulnerability that affected millions of devices. This is a significant, verifiable outcome.
The deeper problem is structural.
When a security researcher discovers a flaw in a widely used product, there is an inherent tension: disclose the vulnerability immediately to warn users, or wait for the vendor to patch it and then disclose. This is a responsible disclosure model. The problem arises when the vendor fixes the flaw but does not disclose it to the users.
This is not an academic issue. Consider the incentives: users of a hardware wallet trust that the device is secure. If a vulnerability is discovered and fixed, but not disclosed, the users are not informed of the risk they were exposed to. They are not given the opportunity to assess the risk and decide whether they need to take additional security measures—such as revoking existing approvals or migrating to new wallets.
The full picture includes the fact that TestMachine's AI agent was able to find this vulnerability, which suggests that AI security research is not just a theoretical concept but a practical reality. The question is whether this is a one-off or a sign of things to come.
The timing of the disclosure is also a factor. TestMachine claims to have shared the vulnerability with Ledger before the public disclosure. The CTO's response was to call it "fear-mongering." This is not a great look for a company whose entire value proposition is security.
Contrarian: What the Bulls Got Right
In the interest of completeness, I will acknowledge the counterarguments.
The Ledger CTO's claim that the disclosure is "fear-mongering" is not entirely without merit, at least in principle. The attack requires a user to visit a malicious website and actively approve a transaction. It is not a remote exploit that can be triggered without user interaction. The vulnerability has been fixed, and the fix has been shipped. If the user updates their firmware, they are no longer vulnerable.
The fact that the fix is in the app's version 1.22.2 suggests that the window of exploitation was relatively narrow. This is a mitigating factor.
Second, the attack is a social engineering vector. It requires the user to be on a malicious website and to approve a transaction, even though they think they are approving a different one. This is a known class of attacks—"approval phishing"—that has been used against various wallets, not just Ledger.
Third, the "quiet fix" strategy is not a unique Ledger practice. Many companies in the crypto space, and in traditional finance, have historically preferred to patch vulnerabilities without a public announcement, to avoid attracting attacker attention. This is a classic debate in the security community.
But here's the problem with this reasoning: the exploit is not a logic flaw in the application, it's a design flaw in the interaction pattern. The user sees a low-value transaction, signs it, and the attacker gets the authorization. The trust assumption is broken, not just for a few, but for all users of the affected devices.
And the "fear-mongering" comment is a defensive reaction that does not help the user. It is a corporate self-protection measure, not a security posture.
The real counter-argument is that the disclosure was necessary.
If Ledger had not been forced to disclose, the user would not have known to update. The entire value of the hardware wallet is the security of the user's assets. When the security is compromised, the user needs to know. The "quiet fix" is a silent withdrawal of trust.
The market will not reprice this event in the short term, because there is no token to sell. But the long-term brand equity is the actual asset at risk. The trust in the "security" of the device is the core promise.
Takeaway: The Accountability Call
The ledger does not lie, only the interpreters do. But in this case, the interpreter is the user, and the user is not a ledger.
The real issue is not whether the vulnerability was fixed. It was. The real issue is whether the user can trust the process that decides what to disclose and what to hide.
The AI security audit is not just a trend. It is a shift in the security landscape. AI will find more vulnerabilities than human auditors, not because humans are not capable, but because AI can run more tests, more efficiently, and across more code bases.
The question is not whether AI will replace human auditors. It is whether the industry will be ready for the disclosure pressure that AI will bring.
The traditional model of "security through obscurity" will not work in an environment where AI agents can scan codebases at machine speed. The industry needs to evolve its disclosure norms.
The question to the industry is: How many "quiet fixes" are still out there, and how long will they stay quiet before the AI finds them?
Disclaimer: This analysis is based on publicly available information and is not investment advice. Crypto assets are subject to high risk and can lead to total loss. Please do your own research (DYOR) and consult with professional advisors.