Ledger app bug lets five signatures leak private keys

Zilliqa disclosed that every version of its Ledger app released between 2019 and 2026 contained an error in the code that generates the ephemeral nonce for Schnorr signatures on the secp256k1 curve. The flaw makes the highest 64 bits of the nonce zero, reducing the nonce range and exposing enough information in public signatures to reconstruct a private key from roughly five signatures within seconds on standard hardware.

The project detected on-chain activity consistent with exploitation on July 19 and confirmed the root cause on July 21. As a protective measure, Zilliqa suspended native, non-EVM transaction processing to prevent further draining of accounts while it finalizes a coordinated migration plan for affected funds. The disclosure did not list affected addresses or quantify any losses.

Technically, the signing routine produced 40 bytes of randomness but copied the wrong 32-byte slice into the nonce buffer, discarding entropy and leaving eight zero-padding bytes at the top of the nonce. That bias makes lattice-reduction attacks practical when an attacker can collect multiple biased signatures created with the same private key.

Because all past signatures are recorded on-chain, updating the Ledger app will stop future signatures from leaking the same bits but cannot remove information already exposed. Zilliqa advises that any account that has broadcast about five or more native transactions signed through the flawed Ledger app should be considered compromised and that affected private keys must be retired. A routine transfer may be front-run by an attacker who has reconstructed the private key and can sign a competing transaction.

Zilliqa is coordinating a migration procedure intended to let legitimate holders move assets while preventing attackers with reconstructed keys from winning transaction races. A corrected Ledger app release is being prepared in cooperation with Ledger to restore full-width nonce generation and prevent future signatures from carrying the same bias. Zilliqa says EVM transactions and the signing paths used by its official SDKs are not affected and that the issue stems from its Ledger app implementation rather than a failure of Ledger hardware.

Zilliqa credited a cryptocurrency exchange with reporting the incident and assisting in recovering affected private keys using publicly available signatures and in tracing the problem to the app’s nonce-generation code. The network has not announced a reopening date or published a final migration procedure.