# Implementation Bugs, Not Just Exploits, Threaten Custody

Cryptographic implementation errors in wallets and signers (biased nonces, reused randomness, faulty derivation) keep surfacing as a distinct custody risk alongside smart-contract exploits, eroding the assumption that certified hardware protects keys.

- Conviction: 40 / 100 (forming)
- Horizon: Emerging (watchlist)
- Tracking since: 2026-07-25T00:00:00.000Z
- Last updated: 2026-07-25T05:46:08.587Z
- Canonical: https://polylog.news/crypto/trends/signing-flaws-undermine-hardware-wallet-trust
- Publisher: Polylog
- Affected regions: Global

## Recent evidence

- [confirms] Zilliqa Halts Native Transfers After a Seven-Year Ledger Flaw Lets Attackers Rebuild Private Keys (2026-07-25): Zilliqa halted native transfers after a biased signing nonce in its Ledger app let attackers rebuild private keys from ~5 signatures via lattice reduction, with exploitation starting July 19 (edition report). A live, actively-exploited nonce-bias bug in certified hardware directly validates that implementation errors, not just contract exploits, are a distinct custody risk.