
Ledger's new proxy detection simulates transactions on Erigon nodes to spot delegatecall opcodes, showing the real logic contract before signing. The Bybit hack lost $1.4B to hidden logic swaps.
Hardware wallet users face a blind spot in Ethereum that attackers have already exploited at scale. Proxy contracts let developers upgrade a protocol's logic without changing the address users interact with. That same design lets an attacker swap the underlying code through malicious calldata, and the transaction can look normal on the surface.
Ledger just closed that gap. The company rolled out smart contract proxy detection for its clear signing process. The feature runs an anonymized transaction simulation on Erigon nodes before the user reviews the request on the device. Execution traces expose every internal operation. When the system spots a delegatecall opcode – the single instruction that makes proxy attacks possible – it identifies the real logic contract and shows its details on the Ledger screen.
The Bybit incident in February 2025 made the danger concrete. Attackers altered a Safe multisig contract's proxy implementation address. The transaction appeared routine. Behind the scenes, the hidden logic redirection let them drain roughly 400,000 ETH plus other assets worth over $1.4 billion. Users had no way to notice the switch before signing.
Ledger's engineers considered building a custom opcode simulator inside the device. Supporting every EVM variant and keeping up with protocol changes would have created heavy maintenance overhead. Instead they turned to production-grade Ethereum nodes. The simulation runs silently during every clear-signed transaction. No user action or configuration change is required.
The approach shifts from standards-based assumptions to direct analysis of EVM execution traces. Many contracts ignore optional standards like ERC-1967. The delegatecall opcode is fundamental to how the Ethereum Virtual Machine works. Detecting it during transaction review reveals whether a proxy is involved and which logic contract will actually run.
For users signing complex DeFi or NFT interactions, the update restores visibility into changes that were previously invisible. Developers keep the flexibility proxies provide. The protection is already live in production.
What would confirm the system works over time: no major proxy-based exploits on Ledger wallets after this update. What would weaken it: attackers finding a way to obfuscate delegatecall traces from the simulation, or a vulnerability in the Erigon node layer itself. For now, the feature addresses a specific attack vector that has already cost the ecosystem over a billion dollars.
Prepared with AlphaScala research tooling and grounded in primary market data: live prices, fundamentals, SEC filings, hedge-fund holdings, and insider activity. Each story is checked against AlphaScala publishing rules before release. Educational coverage, not personalized advice.