Zilliqa halts native transactions over bug in its Ledger app dating to 2019
Zilliqa has suspended native ZIL transactions after uncovering a critical vulnerability in its Ledger application that has existed since 2019, making private keys used for affected transactions recoverable from publicly available onchain signatures.
In a statement posted to X on Wednesday, the Zilliqa team said the vulnerability affects the generation of Schnorr signatures for native Zilliqa transactions. The bug causes signatures to be generated with predictably weakened ephemeral nonces, from which an attacker can recover the signer's private key using publicly available onchain data.
According to the statement, the team observed onchain activity consistent with active exploitation on July 19 before isolating the root cause on July 21. It attributed the issue to incorrect handling of cryptographic nonce data, where the signing routine copied the wrong 32 bytes from a 40-byte value, leaving the most significant 64 bits of each nonce fixed at zero.
That reduction in randomness allowed private keys to be reconstructed from approximately five or more affected signatures using publicly available onchain data, the team said.
Per the statement, protective measures are already in place to prevent further loss, and a coordinated remediation plan is being finalized. A corrected version of the Zilliqa Ledger app is being prepared in coordination with Ledger, with release details to be announced separately.
Meanwhile, users who have signed native Zilliqa transactions with a Ledger device should await official guidance before taking any action, the team said. It added that users who hold or transact with ZIL exclusively through EVM-compatible tooling are not affected by the vulnerability.
The team also credited KuCoin for helping identify the root cause of the app's nonce generation flaw, recovering affected private keys from publicly available onchain signatures, and confirming that the vulnerability was being actively exploited.
Zilliqa said the exchange's reporting and cooperation enabled the implementation of protective measures while the remediation plan was being developed.
Zilliqa's ZIL (ZIL) token traded down 4.8% over the past 24 hours at $0.0024.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
NYSE Parent ICE Eyes Avalanche for 24/7 On-Chain Trading via ATS Platform
Crude Oil sells off and takes it all back on Saudi cargoes through Oman
Jensen Huang: Nvidia chip sales will double next year compared to this year, AI cannot be regulated like social media
Jensen Huang opposes applying social media regulations directly to AI, arguing that social media is a product, while AI is an underlying technology that supports other technologies and products. He believes regulation should target products, not the technology itself. He emphasizes rigorous testing and states that products should be withheld from release if they are not safe enough. "AI safety is of utmost importance."
What to buy after the Federal Reserve raises interest rates? Historically, US energy and technology stocks outperform while real estate lags. Goldman Sachs: The pace of rate hikes determines the US stock market.
U.S. stock performance in the 12 months after the first Federal Reserve rate hike: According to Jefferies, the energy sector led with an average return of 22.4%, followed by information technology at 15.4%. According to Charles Schwab, real estate underperformed the S&P 500 by 4.3%, making it the worst of the 11 sectors. Goldman Sachs states that the pace of rate hikes is the core variable affecting U.S. stocks; currently, if the 10-year U.S. Treasury yield rises by 50 basis points within a month, it will create "rapid rate hike" pressure.
Crypto prices
More
