A hardware wallet is supposed to be the safest place for a private key. For seven years, one popular app running on top of Ledger devices quietly undermined that promise.
The flaw sat inside Ledger's app for Zilliqa, used since 2019 to sign the network's native, non-EVM transactions. Every time the app built a signature, it grabbed the wrong 32 bytes of data — keeping eight bytes of leftover padding instead of eight bytes of real randomness. That randomness is called a nonce, a number meant to be unpredictable every time. When it isn't, anyone who compares a handful of signatures from the same account can work backward and rebuild the private key — no malware, no access to the device, just public data already sitting on the blockchain. Zilliqa says roughly five affected signatures are enough, and the math takes seconds on ordinary hardware.
KuCoin spotted unusual on-chain activity on July 19 and started digging. The root cause was confirmed two days later, and Zilliqa went public with the details on July 22. In between, a cold wallet at a partner exchange was drained of an undisclosed amount of ZIL. Zilliqa halted all native transactions network-wide — EVM-compatible transfers were never affected — and Upbit froze ZIL deposits and withdrawals. The token dropped roughly 17-19% over the week, trading near $0.0024.
The Ledger devices themselves were never compromised; the bug lived in third-party app code, not the secure chip. That's cold comfort for anyone who signed native ZIL transfers through Ledger since 2019: once a signature is on-chain, it's on-chain for good, and a patched app can't undo a key that's already exposed. Zilliqa says the only real fix is to move funds to a fresh address.
It's a reminder that a hardware wallet only protects what the software running on it does correctly — the chip can be flawless and the outcome still broken.
