# Zilliqa Halts Native Transfers After a Seven-Year Ledger Flaw Lets Attackers Rebuild Private Keys

A biased signing nonce in the Ledger app means about five signatures from one key are enough to rebuild that key using lattice-reduction mathematics within seconds. The network says exploitation began on July 19.

- Published: 2026-07-25T05:44:17.130Z
- Canonical: https://polylog.news/crypto/2026-07-25/zilliqa-halts-native-transfers-after-a-seven-year-ledger-fla
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CryptoSlate](https://cryptoslate.com/zilliqa-says-roughly-5-native-ledger-signatures-can-expose-a-key-rescuing-the-funds-becomes-a-race-against-attackers/), [crypto.news](https://crypto.news/zilliqa-ledger-app-flaw-exposes-private-keys-halts-zil-transfers/), [Unchained](https://unchainedcrypto.com/zilliqa-halts-native-transactions-after-ledger-app-flaw-exposes-private-keys/)

The layer-1 network Zilliqa has [suspended native transactions](https://cryptoslate.com/zilliqa-says-roughly-5-native-ledger-signatures-can-expose-a-key-rescuing-the-funds-becomes-a-race-against-attackers/) after concluding that roughly five signatures produced by the same private key can be enough to reconstruct that key. The defect is not a smart-contract bug or a stolen seed phrase. It is a cryptographic implementation error inside the Ledger hardware-wallet app that signs Zilliqa's native (non-EVM) transactions.

The root cause is a biased signing nonce. For each signature the app generated 40 bytes of randomness, reduced the value modulo the secp256k1 curve order, then copied the wrong 32-byte window into the nonce. That mistake fixed the highest 64 bits of every nonce at zero, leaving each value below 2^192. Predictable structure in a signing nonce is the standard condition that lets an attacker apply lattice-reduction techniques and recover the underlying key. Zilliqa says [every version of the app shipped between 2019 and 2026](https://crypto.news/zilliqa-ledger-app-flaw-exposes-private-keys-halts-zil-transfers/) carried the flaw, that it observed on-chain activity consistent with active exploitation on July 19, and that it confirmed the cause on July 21.

Speed now determines the outcome. Because a reconstructed key lets an attacker submit a competing transfer that executes before any ordinary rescue transaction, Zilliqa is building a [migration path](https://unchainedcrypto.com/zilliqa-halts-native-transactions-after-ledger-app-flaw-exposes-private-keys/) rather than telling users to simply move funds. The flaw was confined to the native signing path, and the exchange Upbit placed ZIL on a delisting review.

## What this means

The exposed asset here is the trust premium of hardware wallets, which holders and custodians pay for on the assumption that a device never leaks key material. A deterministic-nonce failure defeats that assumption without any phishing or malware, and the same class of bug (weak or biased ECDSA nonces) has exposed keys before. The parties most exposed are self-custody users of niche signing paths and the wallet vendors whose firmware certifications are the product they sell.

## What to watch

- Whether other chains that rely on the same Ledger native-signing routines audit and disclose similar nonce handling, which would widen the scope of the problem beyond Zilliqa.
- How much ZIL is taken before the migration launches, since a working key-recovery attack that moves faster than the fix would show the transfer halt came too late.
- Whether Ledger issues its own analysis of what went wrong and a firmware patch, which institutional custodians need before trusting the device for other assets.