Zilliqa Ledger App Seven-Year Nonce Flaw Enables Private Key Recovery From Five Signatures — 683 Million ZIL Stolen From 6,772 Accounts

Summary

Zilliqa published an August 24, 2026 post-mortem quantifying the full scope of a critical vulnerability in its Ledger hardware wallet application that has been present since the app's launch in 2019 and was exploited beginning July 19, 2026 to steal 683,130,969.66 ZIL across 66 transactions from 6,772 exposed accounts. The flaw is a nonce generation error in the Schnorr signature implementation for native, non-EVM Zilliqa transactions. The Ledger app correctly generated 40 bytes of randomness for each ephemeral nonce but copied the wrong 32 bytes into the signing buffer, retaining eight bytes of zero padding from the reduction process and discarding eight bytes of actual entropy. The effect is that the most significant 64 bits of every nonce generated by the affected app were fixed at zero for every native Zilliqa transaction signed since 2019. A fixed or predictable high-order nonce bias in an elliptic curve signature scheme allows private key recovery using lattice reduction techniques. Four signatures from the same account are the mathematical minimum required to recover the private key. Zilliqa's bulk scan for exposed accounts used a threshold of five signatures, meaning accounts with exactly four exposed signatures were excluded from the published exposure count. The Ledger hardware itself was not compromised. The vulnerability is confined to the Ledger app's signing logic for native Zilliqa transactions. Ledger's EVM-compatible functionality is unaffected. Legacy native transactions remain paused pending migration to Zilliqa EVM, which awaits an external security audit. KuCoin identified the active exploitation on July 19 and played a central role in confirming the root cause. A corrected Ledger app version has been prepared but cannot protect private keys already exposed by existing on-chain signatures.

Timeline

Domain Intelligence

Context

zilliqa.com scores 60.15 — a low-trust range score for a blockchain network whose native Ledger application carried a cryptographic implementation error for seven years before exploitation. The post-mortem detail that deserves attention beyond the specific loss figure is the mathematical floor: four biased signatures are sufficient to recover a private key using lattice reduction on ordinary hardware. Zilliqa's bulk scan required five. Accounts with exactly four native transactions in the same signer era were absent from the published exposure count. That gap between the mathematical exposure threshold and the measurement threshold is an unknown quantity. Every native ZIL signature published on-chain between 2019 and July 2026 is permanent public record. An attacker with access to chain data and the time to run lattice reduction has a complete dataset. The corrected Ledger app prevents new keys from being generated with biased nonces. It cannot withdraw signatures already on-chain.