Zilliqa has disclosed that a bug in the way its Ledger hardware wallet application signed transactions exposed at least 6,772 user accounts and enabled the theft of 683 million ZIL, the network's native token. The blockchain project laid out the details in a post-mortem, describing a flaw tied to how the app handled the secret data that protects private keys. Zilliqa itself is a public blockchain that went live in early 2019 and made sharding — splitting transaction load across parallel node groups — its central design feature, with ZIL used to pay transaction fees on the network.

According to the post-mortem, a signing bug in the Zilliqa Ledger app left a minimum of 6,772 accounts exposed. A signing bug means the wallet application mishandled the process of approving transactions — the step designed to keep users' funds secure. The flaw sat in the Zilliqa-built application that runs on Ledger's devices rather than in Ledger's hardware itself: Ledger wallets operate through separate, per-blockchain apps that each project supplies, which places that project's own code inside the signing path.

Zilliqa frames the 6,772 figure as a minimum rather than a confirmed final total of everyone affected. The same flaw, the project says, enabled the theft of 683 million ZIL.

Reporting from CryptoSlate traced the issue to the hardware wallet app discarding entropy. Entropy is the randomness used to generate a private key; without enough of it, keys become guessable, which can expose the crypto assets they protect.

Why the Account Count and Token Loss Matter

The 6,772 figure provides a measurable floor for the number of users caught up in the incident. Because Zilliqa describes it as a minimum, the real number of impacted accounts could be higher. The stolen tokens point to the financial weight of the bug: a signing flaw sits at the trust layer of any wallet, so a failure there directly threatens user funds and confidence in ZIL.

The bug was serious enough that Zilliqa halted native transactions on the network, according to The Block, which reported that the flaw dated back to the Ledger app's 2019 code — code written in the same year the network launched, meaning the vulnerable signing path dated to Zilliqa's first year of operation.

What Zilliqa Users Should Take Away

Users who held ZIL through a Ledger device may find their accounts within the exposed group. The incident is a reminder that even hardware wallets, widely regarded as the safer option, can carry app-level flaws.

Nor is this the first time signing has drawn scrutiny in the Ledger ecosystem. Ledger previously moved to patch a separate issue when it fixed an Ethereum signing vulnerability, underscoring how the approval step keeps surfacing as a weak point. The pattern echoes other projects that paused operations after a code-level problem, much like when TAC halted block production over a token supply exploit. Stopping the network buys time, but it also signals how deep the underlying flaw runs.

For regular holders, the practical point is simple: watch official Zilliqa channels for guidance and confirm whether an account falls within the disclosed exposure before moving funds. Two open questions sit behind that advice — whether the 6,772 figure is later revised upward, and what remediation, if any, the project prescribes for keys generated through the flawed app.