Ledger Patched It Quietly, Then Called the Disclosure Fear-Mongering. A Rival Reproduced the Attack Anyway.
A race condition between the display logic and the signing buffer breaks the one promise a hardware wallet exists to make — that what the screen shows is what the key signs — without breaking any cryptography at all.