Zilliqa halts native transactions over bug in its Ledger app dating to 2019
Zilliqa has suspended native ZIL transactions after uncovering a critical vulnerability in its Ledger application that has existed since 2019, making private keys used for affected transactions recoverable from publicly available onchain signatures.
In a statement posted to X on Wednesday, the Zilliqa team said the vulnerability affects the generation of Schnorr signatures for native Zilliqa transactions. The bug causes signatures to be generated with predictably weakened ephemeral nonces, from which an attacker can recover the signer's private key using publicly available onchain data.
According to the statement, the team observed onchain activity consistent with active exploitation on July 19 before isolating the root cause on July 21. It attributed the issue to incorrect handling of cryptographic nonce data, where the signing routine copied the wrong 32 bytes from a 40-byte value, leaving the most significant 64 bits of each nonce fixed at zero.
That reduction in randomness allowed private keys to be reconstructed from approximately five or more affected signatures using publicly available onchain data, the team said.
Per the statement, protective measures are already in place to prevent further loss, and a coordinated remediation plan is being finalized. A corrected version of the Zilliqa Ledger app is being prepared in coordination with Ledger, with release details to be announced separately.
Meanwhile, users who have signed native Zilliqa transactions with a Ledger device should await official guidance before taking any action, the team said. It added that users who hold or transact with ZIL exclusively through EVM-compatible tooling are not affected by the vulnerability.
The team also credited KuCoin for helping identify the root cause of the app's nonce generation flaw, recovering affected private keys from publicly available onchain signatures, and confirming that the vulnerability was being actively exploited.
Zilliqa said the exchange's reporting and cooperation enabled the implementation of protective measures while the remediation plan was being developed.
Zilliqa's ZIL (ZIL) token traded down 4.8% over the past 24 hours at $0.0024.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
The Capital Trends Behind the AI Computing Power Rebound: JPMorgan Fund Flows Reveal Retail Buy-In "Shrinking," Pouring Into Nvidia, SanDisk and Other Computing Power Core Companies
What has been revealed is not a "complete withdrawal of retail investors from AI," but rather a significant slowdown in overall market entry pace under macroeconomic pressure, with stock selections becoming more concentrated. In response to the Federal Reserve's unanimous decision to raise interest rates by 25 basis points, increasing the policy rate to 3.75%–4.00%, JPMorgan's assessment is: if this is simply a withdrawal of last year's "insurance-style rate cuts" during a shallow rate hike cycle—and if corporate earnings remain strong and the Middle East situation does not further spiral out of control—the stock market is still capable of absorbing rising interest rates.
Vote Result 7-2! Bank of Japan Raises Interest Rates at Fastest Pace Since 1990, Does Not Signal a Clearly More Hawkish Stance
The Bank of Japan has raised interest rates to 1.25%, marking the highest level since 1995 and the sixth increase since exiting the negative interest rate policy in March 2024. Out of the nine committee members, Asada and Sato voted against the hike, citing the current economic situation, reflecting ongoing internal disagreements over further tightening. In its statement, the Bank of Japan indicated it will continue to raise rates and adjust the degree of monetary easing, but the forward guidance language showed limited changes from the July statement, without sending notably more hawkish signals.
Crypto prices
More
