A 2019 Zilliqa Ledger flaw let attackers recover private keys from 5 signatures
A nonce bug present in every Zilliqa Ledger app since 2019 let attackers reconstruct private keys from about five on-chain signatures; native transactions are frozen.
In Brief
- A flaw in how Zilliqa’s Ledger app generated nonces left the top 64 bits fixed at zero, enabling private-key recovery.
- Attackers could reconstruct keys from roughly five public on-chain signatures using lattice-reduction math.
- Zilliqa detected active exploitation on July 19 and suspended native transactions two days later.
One of crypto’s oldest bugs just turned dangerous. Zilliqa warned this week that a vulnerability in its official Ledger app let attackers recover users’ private keys from publicly available on-chain data—and the flaw had been sitting there since 2019.
The weakness lives in how the app generated nonces for EC-Schnorr signatures on native (non-EVM) ZIL transactions. As Cointelegraph reports, the most significant 64 bits of the ephemeral nonce were fixed at zero, which sounds minor until you realize it collapses the entropy an attacker needs.
Zilliqa said the issue plainly in a post: “The vulnerability causes signatures to be generated with predictably weakened ephemeral nonces, from which an attacker can recover the signer’s private key.” The company says protective measures are in place and a remediation plan is being finalized.
How the private key recovery works
Schnorr signatures depend on a secret, random nonce. When the top 64 bits are pinned to zero, the remaining bits are weak enough that standard lattice-reduction techniques can recover the private key from as few as five signatures—all of which are already public on the blockchain.
The bug was confined to the Ledger app’s native signing path. Crypto Briefing notes EVM-compatible transactions and Zilliqa’s official SDKs (zilliqa-js, gozilliqa-sdk, pyzil) were unaffected, which limits but does not eliminate the blast radius.
Zilliqa detected active exploitation on July 19 and isolated the root cause on July 21, then suspended all native ZIL transactions. A corrected Ledger app restoring full-width nonce generation has been prepared with Ledger, but the fix only prevents future weakened signatures.
What Zilliqa users should do now
If you signed at least five native Zilliqa transactions with a Ledger device, assume the key is compromised. Zilliqa advises affected users to wait for official guidance rather than take independent action that could expose funds further.
The hard part is that the vulnerability is historical: keys already derived from those signatures can’t be un-compromised by a software update. Affected users must rotate to new keys and move any funds off the exposed address once safe to do so.
It’s a blunt reminder of how long-lived crypto flaws can be. As on-chain activity grows, a seven-year-old signing bug shows that “already on the blockchain” is forever—and that key-handling hygiene matters as much as the math underneath it.
FAQ
Are all Zilliqa holders affected?
Only users who signed at least five native (non-EVM) Zilliqa transactions with a Ledger device are considered compromised.
Is EVM or software-wallet ZIL at risk?
No. The bug is confined to the Ledger app’s native signing path; EVM transactions and Zilliqa SDKs are unaffected.
Has the flaw been fixed?
A corrected Ledger app restoring full-width nonces is prepared with Ledger, but it only prevents future weakened signatures—affected keys must be rotated.
