Singapore-founded blockchain Zilliqa suspended all native ZIL transactions on July 21, 2026 after the team confirmed that a bug in its Ledger hardware wallet companion app had been silently weakening the security of every native transaction signed through the device since the app launched in 2019. The project disclosed the vulnerability publicly on July 22 via its official account on X. According to blockchain monitoring reported by Crypto Briefing and CryptoTimes, active exploitation began at least two days earlier, on July 19, and an unnamed exchange partner reported that ZIL tokens had been stolen from a cold wallet by July 20.

A Code Error That Zeroed Out Seven Years of Cryptographic Protection

The flaw lives inside the Ledger app's signing routine for EC-Schnorr signatures, the cryptographic scheme Zilliqa uses for native (non-EVM) transactions. The routine correctly generated 40 bytes of randomness, but it copied the wrong 32 bytes into the nonce buffer. The error retained eight zero-padding bytes left over from an intermediate calculation, discarding eight bytes of real entropy in the process. The result: the top 64 bits of every nonce generated by the app were fixed at zero, drastically narrowing the range of possible values from the full 256-bit space down to at most 2¹⁹² possible values.

Zilliqa's official statement described the outcome plainly. "The vulnerability causes signatures to be generated with predictably weakened ephemeral nonces, from which an attacker can recover the signer's private key," the project posted on X (@zilliqa, July 22, 2026).

The attack method is not novel. Lattice reduction, a well-established mathematical technique, allows an attacker who collects as few as five on-chain signatures from a compromised key to reconstruct that private key within seconds. This vulnerability class has caused serious real-world losses before: a similar random-number generation flaw in Android's SecureRandom implementation led to approximately $5.7 million in Bitcoin wallet losses in the early 2010s. Every signature ever produced by the flawed Zilliqa Ledger app is permanently recorded on the blockchain, meaning updating the Ledger application does nothing to protect keys that have already been used.

Scope: What Is and Is Not Affected

The vulnerability is limited to native Zilliqa transactions processed through the Ledger app. Zilliqa's official software development kits, including zilliqa-js, gozilliqa-sdk, and pyzil, are not affected. EVM-compatible transactions handled via Ledger are also unaffected. Zilliqa launched its EVM-compatible upgrade, Zilliqa 2.0, in June 2025, and native transaction activity conducted before that upgrade remains exposed to the flaw.

This is the second publicly disclosed security incident at Zilliqa in roughly 18 months. In February 2025, the team disclosed a separate vulnerability in its X-Bridge token manager contracts. The repetition raises questions about code review and third-party audit coverage across the project's tooling.

Market Reaction and Exchange Fallout

ZIL was trading around $0.0024 at the time of disclosure, down approximately 17% over the prior seven days. The token has declined roughly 99% from its all-time high of $0.2563, reached in May 2021. Market capitalization sits between $46 million and $60 million depending on the data source.

Upbit, South Korea's largest crypto exchange by volume, froze ZIL deposits and withdrawals on July 20 and has placed the token under formal delisting review, citing the Ledger flaw as the trigger. The review period runs until the week of August 17, 2026. A delisting would significantly reduce liquidity across Asian markets, where a large share of ZIL trading volume originates.

A Direct Warning for Self-Custody Users in South Asia and Africa

The practical stakes extend well beyond institutional accounts. Hardware wallet adoption has grown steadily among retail users across South Asia. India in particular has been a historically notable market for Zilliqa owing to the project's early developer outreach across the Asia-Pacific region, and it ranks alongside Pakistan and Bangladesh as a growing center of hardware wallet self-custody. Across Sub-Saharan Africa, in markets including Nigeria, Ghana, Kenya, and South Africa, Ledger devices are increasingly used as long-term self-custody solutions by users who prefer to hold assets off exchanges.

Any user who signed five or more native ZIL transactions through a Ledger device before July 21, 2026 should treat the associated private key as potentially compromised. South Asia alone recorded roughly $300 billion in crypto transaction volume in the first half of 2025, according to TRM Labs, and hardware wallet penetration in the region has grown alongside that volume.

Zilliqa has issued an explicit warning: do not attempt to move funds independently. Because attackers may have already reconstructed a compromised private key using on-chain signature data, any user-initiated transfer could be front-run before it settles. Affected users should hold and wait for the coordinated remediation plan Zilliqa is developing alongside Ledger.

What Comes Next

Zilliqa says a corrected version of the Ledger app is in preparation and that a full post-mortem will be published once the investigation concludes. The mid-August deadline on Upbit's delisting review creates a concrete timeline for the team to demonstrate progress.

This incident raises broader questions about whether third-party companion apps for hardware wallets on smaller chains receive adequate security scrutiny relative to the wallets themselves. It is a gap the broader industry has yet to systematically address.