Ledger Patched Ethereum App Bug Quietly, CTO Accuses AI Firm of Fear-Mongering

Ledger pushed a silent patch for an Ethereum application bug on August 12. Its chief technology officer then accused the AI security firm that disclosed the flaw of manufacturing fear. The episode began weeks earlier when an artificial intelligence security company identified a vulnerability in Ledger's Ethereum app. The firm followed coordinated disclosure practices, reporting the issue privately. Ledger developed and deployed a fix on August 12 but did not publish a security advisory or release notes describing the flaw. The pivot arrived when the AI firm went public with its findings. Ledger's CTO responded by characterizing the disclosure as fear-mongering, arguing the bug had already been remediated and posed no active risk to users. The statement framed the researcher's publicity tour as opportunistic rather than protective. CoinGecko data shows ledger's Ethereum app manages transaction signing and blind-signing protections for the network's 120.68 million circulating ether. A flaw in that code path could theoretically allow a malicious transaction to bypass user verification. The company has not released technical details of the vulnerability class or the attack vector it closed. per CoinGecko, Ethereum traded at $2,456.02 at 14:00 UTC on August 23, up 1.9% in the prior 24 hours and 31.2% over the past seven days. The seven-day close series shows a steady climb from $1,901.10 to $2,377.02 before the latest session.

The dispute mirrors a broader standoff in crypto security. Hardware wallet vendors prefer quiet fixes to avoid signaling attack surface. Researchers argue that silent patches deprive users of the chance to verify remediation and erode trust in the disclosure process. Ledger has faced similar criticism after previous firmware updates shipped without changelogs. No funds have been reported lost due to this specific bug. The AI firm has not published a proof-of-concept exploit. Ledger has not committed to a timeline for retrospective disclosure or a public post-mortem. What to watch next: whether Ledger publishes a technical write-up, whether the AI firm releases exploit code, and whether other hardware wallet makers adopt clearer disclosure policies in response.