Daily News 19

Tag: Ledger

  • Cosmos Back Online After Outage, but Ledger Users Still Unable to View or Send ATOM

    Cosmos Back Online After Outage, but Ledger Users Still Unable to View or Send ATOM

    Ledger Wallet Cosmos ($ATOM) Outage Enters Fifth Day as Network Recovers

    Ledger’s status page continued to list Cosmos ($ATOM) as a major outage on September 13, leaving users unable to view $ATOM balances or transaction history and unable to submit transactions through Ledger Wallet more than four days after the incident began.

    Incident Timeline and Current Status

    The company opened the incident at 19:41 CEST on September 8. As of press time, its latest update, posted at 16:12 CEST on September 10, said restoration work was continuing and that the affected features remained unavailable. Ledger has not disclosed a cause or an estimated restoration time.

    The continuing warning does not mean Cosmos Hub is still halted. It shows that Ledger Wallet’s service path for retrieving account data and sending $ATOM transactions has not recovered with the network itself.

    Cosmos Hub Recovered Before Ledger Wallet

    QuickNode reported that Cosmos Mainnet stalled at block 32,878,318 at 18:12 UTC on September 8. The infrastructure provider said its nodes had returned to the chain tip by 14:26 UTC on September 9, then marked its incident resolved at 00:24 UTC on September 12.

    The Cosmos Hub RPC endpoint was above block 32.9 million on September 12 and reported that the node was not catching up. That placed the chain tens of thousands of blocks beyond the height in QuickNode’s initial alert.

    Together, those readings separate two layers of the problem. Cosmos Hub resumed producing blocks, while Ledger Wallet access remained unavailable. Users may therefore see missing balances or history in Ledger Wallet even though the network is processing new blocks.

    QuickNode’s resolution applies to its infrastructure, while Ledger’s separate incident remains identified. Those states can coexist because a wallet interface can stay unavailable after network nodes have caught up. Ledger has not said which part of its service path is responsible.

    Workarounds for Urgent Transactions

    For users who need to move $ATOM urgently, Ledger’s incident notice points to its alternative-methods guide. The company lists Cosmostation and Keplr as compatible third-party interfaces that can connect to a Ledger device.

    Ledger’s Keplr instructions tell users to open the Cosmos app on their device and choose Keplr’s hardware-wallet connection option. That route uses another interface to access the same blockchain account while keeping the Ledger device in the transaction flow.

    Critical Security Distinction

    The safety distinction is critical: connecting a hardware wallet is not the same as importing its recovery phrase. Ledger’s security guidance says users should never enter the phrase into a computer or smartphone and should never share it, including with Ledger.

    Users who do not need to transact urgently can continue monitoring Ledger’s status page. Because the incident remains open and could change without notice, its status should be refreshed before any workaround is attempted.

  • Ledger Denies Hack Claims as Patched Ethereum App Vulnerability Emerges

    Ledger Denies Hack Claims as Patched Ethereum App Vulnerability Emerges

    Ledger has denied hacking allegations following the publication of a laboratory demonstration showing a technical flaw in an outdated version of its Ethereum application. The hardware wallet manufacturer clarified on Thursday, August 27, 2026, that the security patch had been deployed prior to the public disclosure of the vulnerability.

    No Ledger user was hacked.
    What’s described here is a lab reproduction of a vulnerability in an outdated version of the Ethereum app.
    The issue was already identified through our security process and fixed in Ethereum app 1.22.2, released August 13, before this post. The…
    — Ledger (@Ledger) August 27, 2026

    Origin of the Controversy

    The controversy began when security researchers from rival firm OneKey posted on social media that they had successfully recreated an attack in a controlled lab setting. OneKey CEO Yishi Wang stated that the weakness stemmed from a race condition between the data buffer and the physical device’s visual interface. This flaw allowed an attacker with control over the intermediary software to overwrite a transaction while the user was reviewing the legitimate operation on screen. Technical data shared by the researchers indicates that this vector could redirect funds to external wallets without reflecting the modification on the physical device.

    Ledger’s Response and Technical Rebuttal

    Ledger’s Chief Technology Officer, Charles Guillemet, immediately rejected the narrative of a security breach in the manufacturer’s infrastructure. The company’s official documentation notes that reproducing a bug on an obsolete version within a lab does not constitute an active vulnerability or a compromise of user funds. The bulletin issued on August 27, 2026, specifies that an attack of this nature required the host computer to be previously compromised by malware or connected to a malicious web platform. Additionally, the technical report confirms that the private keys stored in the hardware’s secure element were never exposed.

    Patch Timeline and Technical Details of the Vulnerability

    The issue originated in the internal application designed to manage transactions on the Ethereum network and compatible tokens. In version 1.22.1, a malicious web application with permissions to connect to the device could send a secondary signing instruction while the user was examining the first.

    The manufacturer identified the issue internally and rolled out update 1.22.2 on August 13, 2026. The firm’s report details that the changes introduced two key safeguards: rejecting new signing sessions while a review is underway and voiding confirmations if the memory state differs from what is displayed on the screen.

    To secure the application ecosystem, the development team updated its software development kit (Secure SDK) to version 26.6.1 on August 21, 2026. Through this procedure, the company rebuilt the entire application catalog to prevent similar vectors across other digital assets.

    User Guidance and Ongoing Monitoring

    The Ledger Donjon security research team noted that this incident highlights the need for regular update practices on cold wallets. The modular hardware architecture allows patches to be applied to peripheral software without compromising the original recovery seed.

    To verify device protection, users should check in Ledger Live that the Ethereum app is updated to version 1.22.3 or higher. The manufacturer will continue monitoring its software repositories and will publish new update logs in its application manager during upcoming scheduled reviews.