Ledger Monero app exposed Keccak state, letting a compromised host recover spend keys

June 4, 2026LedgerHigh

Who is affected

Monero holders using a Ledger Monero app older than 2.1.4 on a compromised computer could have their secret view and spend keys extracted without any prompt on the device while the app was open. Ledger states the issue is fixed in Monero app 2.1.4 and that the prerequisites considerably limit practical exploitability.

What happened

Ledger’s security bulletin LSB-022 describes a flaw in the Monero app for Ledger Nano devices. According to Ledger, the handler for the INS_GET_CHACHA8_PREKEY command returned the full 200-byte internal Keccak state instead of a derived prekey. Because the Keccak-f permutation is public and invertible, Ledger states that anyone able to send this command to the device could work back from that state to the secret view key and the secret spend key. The spend key is the key that authorises spending from a Monero wallet.

Ledger lists the conditions for exploitation: a vulnerable Monero app version is installed, the device is unlocked, the app is open, and the host computer is compromised so that it can send the malicious command. The command required no confirmation on the device. Ledger states that these prerequisites considerably limit the attack’s practical exploitability. This is a different flaw from the 2020 Monero spend-key extraction (CVE-2020-6861, fixed in app 1.5.1), which abused the transaction-signing protocol; LSB-022 concerns a separate command in the 2.x app line.

Ledger states that version 2.1.4 fixes the issue: the prekey is now derived with SHAKE256 and a domain-separation label, only the secret view key is used as input rather than both secret keys, and sensitive intermediate buffers are cleared after use. The app’s public changelog describes 2.1.4 as a fix to the ChaCha8 prekey response, which now returns a deterministic 200-byte SHAKE-256 output.

According to the bulletin, the flaw was identified during an internal security review on 16 March 2026, a fix was developed on 19 March and version 2.1.4 was released on 20 March (the app’s changelog dates 2.1.4 to 19 March). The fix was published in the open-source repository on 3 June and the bulletin on 4 June 2026.

What Ledger advises:

Update the Monero app to version 2.1.4 or later.

Sources

Independent reporting and research this entry was checked against.

Learn more

Guides on protecting yourself against this type of incident (Firmware vulnerability) and the glossary terms that describe it.

Can Hardware Wallets Be Hacked?

Hardware wallets are extremely secure, but not invincible. Understand the real risks and attack vectors.

Read Guide

Is a Hardware Wallet Really Safe?

Hardware wallets are the safest option for most people — but you can still make mistakes. Here's what to know.

Read Guide

Firmware

Firmware is the software that runs on a hardware wallet itself: it generates keys, shows transaction details on the screen and signs.

Bootloader

A bootloader is a small program that initializes hardware and loads the main operating system or firmware on a device, often used in blockchain hardware wallets for secure startup.

Firmware Update

Firmware Update installs new low-level software on a hardware wallet to fix bugs, enhance security, or add features in cryptocurrency devices.

Cite this entry

WalletInsights. “Ledger Monero app exposed Keccak state, letting a compromised host recover spend keys”. Hardware wallet security incident tracker. Last verified November 4, 2026. https://walletinsights.io/en/security-incidents/ledger-monero-app-keccak-state-key-recovery-2026/

Corrections and right of reply

Vendors, researchers and readers can send corrections or statements to security@walletinsights.io. We check them against the sources, update the entry and record the change in its log.

All Ledger incidents

All incidents All Ledger incidents