7-Year Ledger Bug Lets Attackers Rebuild Zilliqa Private Keys from 5 Signatures

What happened (short version)

Zilliqa paused native, non-EVM transactions after a nasty old bug in the Ledger app turned Schnorr signatures into a privacy and security giveaway. The signing code produced nonces that were too predictable — the top 64 bits were always zero — which means an attacker who collects only a handful of affected signatures (around five) can use math tricks to rebuild the private key in seconds on a normal computer.

The technical bits, but explained like you’re not a cryptography robot

The Ledger app responsible for native Zilliqa signatures generated 40 bytes of randomness, mashed that down modulo the secp256k1 order, and then copied the wrong slice of bytes into the nonce buffer. The result: eight bytes of actual randomness got thrown away and eight zero bytes were left in their place, so every nonce ended up smaller than 2^192. That’s a big no-no for Schnorr — it’s like leaving fingerprint-size holes in a lock.

With multiple weakened signatures from the same private key, lattice-reduction techniques make reconstructing the key easy and fast. Because blockchain signatures are public and permanent, any affected signatures already broadcast on-chain can’t be taken back — updating the app stops future leaks but can’t erase the past.

The bug appears to affect Ledger app versions released between 2019 and 2026. Zilliqa says EVM transactions and several official SDK signing paths were not affected. The project is working with Ledger on a corrected app that restores proper nonce generation.

What you should do (practical and slightly panicked advice)

If you used a Ledger device to sign native Zilliqa transactions, assume any account that produced around five or more such signatures is compromised. The exposed signatures live on-chain forever, so those private keys should be retired — not patched, not updated, but abandoned.

Don’t try to be heroic and move funds immediately unless there’s an official migration plan in place. An attacker who already reconstructed a key can try to front-run your transfer and beat you to the funds. Wait for the official coordinated remediation instructions from the project before taking action.

When the fixed Ledger app lands, install it to stop new signatures from leaking entropy. But also generate fresh addresses and move assets only once it’s safe to do so (and you understand the migration procedure). If you’re storing lots of value, consider using a different wallet type or hardware key generation that hasn’t been touched by this bug.

Bottom line: treat affected accounts as burnt, wait for official guidance, update the app when it’s released, and move funds carefully — because a few tiny zeros in the wrong place can ruin your day.