Zilliqa Ledger App Vulnerability Affects Native Transaction Security

Zilliqa has announced that its Ledger app has a serious vulnerability affecting the generation of Schnorr signatures for native Zilliqa transactions. This vulnerability impacts all versions released between 2019 and 2026, with signs of suspected active exploitation detected on July 19 and the root cause confirmed on July 21. The vulnerability allows the temporary random number (nonce) used during signature creation to be predictable, enabling attackers to reconstruct the signer's private key using publicly available on-chain data. Zilliqa advises users who have signed native transactions using Ledger devices to await official guidance and refrain from taking independent action. The vulnerability arises from the signature program copying the wrong byte range when writing the random number, resulting in generated random numbers being fixed at up to 64 bits of zero, leading to insufficient entropy. Attackers can recover the private key within seconds by exploiting five or more affected signatures. Transactions affected have been permanently recorded on-chain, and updating the signature application cannot reverse this risk; the related private keys must be discarded. Currently, native transactions have been paused to prevent further losses, and a fix is being confirmed. EVM transactions and SDKs such as zilliqa-js, gozilliqa-sdk, and pyzil are not affected.

Disclaimer: This content is provided for general branding and informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online events, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets or to use any services. Crypto assets are highly volatile and may result in loss. WEEX services and online events may not be available in all regions and are subject to applicable laws, regulations, and eligibility requirements. You are responsible for ensuring that your use of WEEX services complies with local laws and for carefully assessing the risks before participating in any crypto-related activities.