Zilliqa Halts Native Transactions Due to 7-Year-Old Ledger App Bug

Zilliqa has suspended native transactions after discovering a 7-year-old bug in its Ledger app implementation that can expose private keys from approximately five signatures. The vulnerability, which affects all versions of the app released between 2019 and 2026, occurred due to biased nonces generated by the signing routine.

An attacker can combine these affected signatures to reconstruct the corresponding key within seconds on commodity hardware. Since the compromised signatures remain permanently available on-chain, updating the app cannot remove the exposed information, and affected private keys must be retired.

The network has paused native transactions as a protective measure, halting further draining of affected accounts. A coordinated migration plan is being developed to allow legitimate users to migrate their assets while preventing attackers with the same signing authority from front-running the transaction.