Zilliqa has disclosed a critical security vulnerability in its Ledger application that could allow attackers to reconstruct users' private keys from public signatures after as few as five native Zilliqa transactions. The flaw, first identified by blockchain industry observers, has raised alarm across the cryptocurrency community and drawn heightened scrutiny from exchanges.

Nature of the Vulnerability

The vulnerability specifically affects the generation of Schnorr signatures for native (non-EVM) Zilliqa transactions within the Zilliqa Ledger app. Due to a flaw in nonce generation, signatures are produced in a manner that exposes enough cryptographic information to allow private keys to be derived from publicly visible transaction signatures after a small number of operations. Nonce reuse or predictable nonce generation is among the most studied failure modes in digital signature schemes; when a nonce is compromised or partially revealed, the mathematical relationship between successive signatures can be exploited to solve for the private key. Critically, only native Zilliqa transactions are affected — EVM-based transactions on the network use a different signing path and are not impacted.

Private keys are the cornerstone of cryptocurrency wallet security. Any compromise of these keys could grant unauthorized access to a user's digital assets, making this class of vulnerability among the most severe in blockchain infrastructure. The fact that the flaw resides within a Ledger hardware wallet application is particularly notable, as Ledger devices are among the most widely used cold-storage solutions and are generally trusted to isolate private keys from network-exposed environments. Security experts consistently emphasize that robust private key protection is essential to maintaining trust in cryptographic systems.

Exchange Response: Upbit Designates ZIL as Cautionary Asset

In the wake of the disclosure, South Korean cryptocurrency exchange Upbit designated ZIL as a cautionary asset. This classification indicates that the exchange is actively monitoring the situation and is advising users to exercise heightened caution when trading or holding the token. South Korean exchanges operate under a regulatory framework that requires strengthened investor protections, and cautionary designations can trigger additional disclosure obligations and trading restrictions.

The designation reflects a broader pattern of increased vigilance among exchanges as they assess the potential impact of the Ledger application vulnerability on ZIL holders.

Separate Cold Wallet Incident Under Investigation

The Ledger vulnerability disclosure follows a separate security event involving the theft of ZIL tokens from an exchange partner's cold wallet. Zilliqa confirmed it was aware of the incident on July 20, 2026:

We have been made aware of a security incident involving one of our exchange partners, in which ZIL was stolen from a cold wallet. The incident is under active investigation, and we are working with the relevant parties to establish the root cause and full scope. As a… — Zilliqa (@zilliqa) July 20, 2026

https://x.com/zilliqa/status/2079148672122818621?ref_src=twsrc%5Etfw

Zilliqa stated that the incident is under active investigation and that the project is cooperating with relevant parties to determine the root cause and full scope of the theft. The two incidents are unrelated in nature but collectively contribute to concerns about the ecosystem's overall security posture.

Official Disclosure of the Ledger Vulnerability

On July 22, 2026, Zilliqa officially disclosed the technical details of the Ledger app vulnerability:

Nonce-Generation Vulnerability in the Zilliqa Ledger App: A critical vulnerability has been identified in the Zilliqa Ledger application affecting the generation of Schnorr signatures for native (non-EVM) Zilliqa transactions. The vulnerability causes signatures to be generated… — Zilliqa (@zilliqa) July 22, 2026

https://x.com/zilliqa/status/2079847348780536050?ref_src=twsrc%5Etfw

Implications for User Confidence and Market Sentiment

Zilliqa, which launched in 2018 as one of the first public blockchains to implement sharding for scalability, has positioned itself as a platform focused on distributed ledger innovation. The project now faces a significant operational challenge. The disclosure places Zilliqa under increased scrutiny as market participants evaluate both immediate and long-term implications.

Repeated security issues affecting different components of a blockchain ecosystem can influence investor sentiment and slow user adoption, according to market observers. Upbit's classification of ZIL as a cautionary asset reflects this heightened market vigilance.

The incident also underscores the broader importance of maintaining rigorous security standards across all cryptocurrency applications. As blockchain networks expand their ecosystems, the integrity of wallet software and cryptographic implementations remains essential for protecting users against emerging threats. Similar nonce-related vulnerabilities have been documented in other cryptographic implementations across the industry, reinforcing the need for continuous auditing of signing logic.

Industry Watches for Remediation

Industry participants are closely monitoring Zilliqa's response, including any software updates, security patches, or guidance issued to affected Ledger application users. A swift and transparent remediation effort could help restore confidence, while delays or inadequate measures risk prolonging uncertainty. Key milestones include a patched Ledger app release, guidance for users who have already signed five or more native Zilliqa transactions, and any exchange policy updates beyond Upbit's initial designation.

Investors and traders are paying close attention to further announcements from Zilliqa, Ledger, and cryptocurrency exchanges regarding mitigation efforts and recommended security measures. Exchange policies, wallet updates, and community responses are factors that could influence trading activity and investor sentiment in the coming weeks.

The effectiveness of Zilliqa's remediation efforts and its communication strategy are expected to play a decisive role in restoring user trust and maintaining the project's long-term market position. The platform's handling of the vulnerability is likely to shape perceptions of its reliability and resilience in the months ahead.

The Zilliqa incident highlights the importance of continuous security audits, timely vulnerability disclosures, and rapid response mechanisms to safeguard users and preserve confidence in blockchain ecosystems as the industry continues to evolve.