Written by Zoltan Vardaistaff writerReviewed by Yohan Yunstaff editor

Written by Zoltan Vardaistaff writer

Reviewed by Yohan Yunstaff editor

Zilliqa Ledger app vulnerability lets attackers recover signer’s private keys

Latest NewsPublishedJul 22, 2026

A security vulnerability in the Zilliqa Ledger app is enabling attackers to reconstruct private keys using publicly available onchain data.

Layer-1 blockchain network Zilliqa warned that a vulnerability in the Zilliqa Ledger app could allow attackers to recover users’ private keys using publicly available onchain data.

“The vulnerability causes signatures to be generated with predictably weakened ephemeral nonces, from which an attacker can recover the signer’s private key,” Zilliqa stated in a Wednesday X post.

Zilliqa stated protective measures are in place to prevent further losses and that a coordinated remediation plan is being finalized. Users who signed at least five native Zilliqa transactions with a Ledger device are considered compromised and are advised to await further guidance before taking any action.

The warning comes after Zilliqa on Monday asked exchanges to temporarily pause Zilliqa (ZIL) deposits and withdrawals after identifying a security vulnerability that resulted in the theft of an undisclosed amount of ZIL from a cold wallet.

Zilliqa stated it will publish a corrected version of the app in coordination with Ledger. It stated that users transacting ZIL through EVM-compatible tooling were not affected.

The ZIL token fell 1.5% in the past 24 hours and 17% over the past week, to trade above $0.0024 at publication, as reported by CoinMarketCap.

Magazine: How a ‘Wrong Number’ message turned into a $3.4M crypto scam

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

• Zilliqa
• Cybersecurity
• Hackers
• Hacks
• Ledger
• Private Keys
• Scams & Cybercrime

More on the subject

US seeks forfeiture of $25M in crypto tied to romance, investment scams

1 hour ago

Ezra Reguerra

SecondFi to wind down after $2.6M ADA theft linked to wallet flaw

3 hours ago

Helen Partz

Allbridge pauses cross-chain bridge after $1.65M exploit

Jul 20, 2026

Felix Ng

US seeks forfeiture of $25M in crypto tied to romance, investment scams

1 hour ago

Ezra Reguerra

SecondFi to wind down after $2.6M ADA theft linked to wallet flaw

3 hours ago

Helen Partz

Allbridge pauses cross-chain bridge after $1.65M exploit

Jul 20, 2026

Felix Ng