Zilliqa said on-chain activity suggested active exploitation and warned affected Ledger-signed native accounts may need full key migration once a coordinated recovery plan is finalized.
Zilliqa suspended native, non-EVM transactions after finding a flaw in the Zilliqa Ledger app that could let attackers reconstruct a private key from roughly five affected Schnorr signatures. The network said it detected on-chain activity consistent with active exploitation on July 19 and confirmed the root cause on July 21. The issue affects every version of the app released between 2019 and 2026 and stems from a nonce-generation error that discarded entropy and fixed the nonce’s highest 64 bits at zero, allowing key recovery within seconds using lattice-reduction techniques. Zilliqa said any account with about five or more native transactions signed through the Ledger app should be treated as compromised, and warned that a normal rescue transfer could be front-run by an attacker holding the same signing authority. A patched app is being prepared with Ledger, but signatures already recorded on-chain mean exposed keys must ultimately be retired. Zilliqa credited KuCoin with reporting the issue and said EVM transactions and the zilliqa-js, gozilliqa-sdk, and pyzil SDK signing paths are unaffected.