All news is verified and thoroughly reviewed by leading blockchain experts and seasoned industry insiders.
- Zilliqa has suspended local transactions after identifying a serious security vulnerability in its Ledger wallet app.
- The flaw could allow attackers to reconstruct private keys from transaction signatures generated over several years.
- Exchanges have restricted ZIL transfers while the network prepares recovery instructions for affected users.
- The issue is limited to the native Ledger implementation of Zilliqa and does not affect Ledger devices or the EVM network.
Zilliqa has suspended all native (non-EVM) transactions after confirming a critical vulnerability in its Ledger hardware wallet application, a flaw that could allow attackers to recover users’ private keys from publicly available blockchain signatures. This emergency measure comes as the project works with security researchers and exchanges to contain the incident and develop a recovery process for potentially affected users.
According to the advertisement in XThe vulnerability is limited to Zilliqa’s native blockchain and does not affect its EVM-compatible network.
The Ledger devices themselves also remain unaffected, as the issue is limited to the Zilliqa Ledger app software implementation.
The investigation traced the flaw to a years-old coding error
According to Zilliqa, the vulnerability arose from an implementation error in its use of Schnorr signatures, the cryptographic system used to allow local transactions.
As the investigation progresses, we would like to make an important point:
At this point, we have found no evidence that the incident was caused by the exchange’s portfolio management or operational processes. We appreciate the stock exchange’s cooperation in determining… https://t.co/i6UQ62m4CM
– Zilliqa (@zilliqa) July 20, 2026
Instead of generating completely random numbers for each signature, a temporary copy error caused the top 64 bits of each number to be replaced with zeros. This significantly reduced the randomness protecting each signature, creating conditions where attackers could reconstruct private keys using network minimization techniques after observing enough on-chain transactions.
The project said the vulnerable code was present in every version of the Zilliqa Ledger app since its initial release in 2019, meaning the flaw remained undetected for about six years.
The investigation was accelerated after suspicious activity was discovered on the chain on July 19. Working alongside exchange partners, including KuCoin, engineers traced the attacks back to the Ledger app signing process before publicly confirming the vulnerability on July 21. A day later, Zilliqa suspended all local transactions while mitigation efforts began.
Only a specific group of users is considered at risk
The vulnerability does not affect every ZIL holder equally. Based on the project guidance, the group most at risk includes users who:
- The ledger device was used for original (non-EVM) ZIL transactions.
- Transactions signed between 2019 and July 2026.
- Approximately five or more signatures were created with the same private key.
The project confirmed that many parts of its ecosystem were not affected:
- Ledger devices were not compromised.
- Zilliqa’s EVM-compatible blockchain technology continues to function normally.
- Software wallets are not affected by the vulnerability.
Zilliqa urged potentially affected users not to move funds or attempt independent recoveries until official immigration instructions are published, warning that taking premature action could complicate the recovery process.
Exchanges are moving quickly to contain the potential fallout
This revelation led to immediate action across cryptocurrency trading platforms.
South Korea Upbit ZIL is classified as a warning assetIt suspended deposits and withdrawals, and placed the token under delisting review until mid-August under the country’s investor protection framework.
Other centralized exchanges have also temporarily restricted transfers of original ZIL while assessing the potential impact of both the Ledger app vulnerability and separate theft reports involving ZIL held in an offline cold wallet managed by one of the ecosystem’s exchange partners. Although the incidents are different, their recent timing has heightened concerns throughout the market.
Investor sentiment deteriorated after the disclosure. ZIL fell about 5% over the past 24 hours and about 17% over the past week, falling to about $0.0024 as traders assessed the scale of the security incident.
The recovery now depends on replacing exposed portfolios
Unlike many software vulnerabilities, this incident extends beyond simply deploying a patched application. Because weak transaction signatures are permanently recorded on the blockchain, updating the Ledger app cannot eliminate exposure associated with signatures created over the past six years.
The next phase of the response will therefore focus on migrating affected users to newly created wallets rather than restoring compromised wallets. This process is expected to require coordination between Zilliqa, Ledger, cryptocurrency exchanges, and wallet holders before native network activity fully returns to normal.
