Zilliqa halts ZIL transfers after critical Ledger flaw

The Zilliqa blockchain network suspended all native ZIL transactions on July 22, 2026, after discovering a critical vulnerability in its Ledger hardware wallet application that had existed since 2019. The flaw allows attackers to reconstruct a user's private key from publicly available on-chain signatures, putting funds at risk for anyone who has signed native ZIL transactions with a Ledger device.

The vulnerability is specific to the generation of Schnorr signatures for native, non-EVM ZIL transactions on Ledger devices. According to Zilliqa, a coding error in the app's signing routine copied the wrong 32 bytes from a 40-byte value, which fixed the top 64 bits of each ephemeral nonce at zero. This dramatic reduction in cryptographic randomness means an attacker could mathematically derive a private key from approximately five or more affected signatures using only public blockchain data. The project emphasized that this issue does not affect transactions made through Zilliqa's EVM-compatible environment or its official software development kits.

Zilliqa's investigation timeline indicates the team first detected on-chain activity consistent with active exploitation on July 19....