Key Takeaways:
Zilliqa confirms 683.13 million ZIL was stolen across 66 transactions after a Ledger hardware wallet bug exposed private keys for at least 6,772 accounts.
The post-mortem, published Aug. 24, said the affected Ledger application generated 40 random bytes but copied the wrong 32 bytes into its signing buffer, retaining eight bytes of zero padding and discarding eight bytes of entropy. That forced the high 64 bits of every affected nonce to zero.
Four or more biased signatures produced by the legacy application for the same account could allow an attacker to reconstruct its private key from public blockchain data in seconds on ordinary hardware, according to Zilliqa. Already-published signatures cannot be withdrawn, so correcting the application protects new keys but cannot repair keys already exposed. The bulk scan behind the published count required at least five native signatures in a single signer era, omitting accounts with exactly four signatures from the population total. Zilliqa's live per-address checker uses tighter parameters and reports four-signature cases, while re-running the wider scan under those parameters remains outstanding.
Legacy transactions remain paused. Zilliqa's recovery plan calls for migrating every legacy holder to Zilliqa EVM, with the legacy side retired, but the migration-tool launch date depends on an external security audit, review of its findings, and any required remediation.
The post-mortem separates 51 drained accounts from the 6,772 accounts whose private keys were shown to be exposed, leaving the number of affected people unquantified. The exposed-account total is a floor, and the 683.13 million ZIL figure could rise if investigators prove additional compromised accounts produced theft transactions.
Zilliqa's historical reconstruction dated the first proven theft to March 4. KuCoin reported anomalous outgoing transactions from one of its cold wallets on July 19, roughly four and a half months later. On July 20, the attacker's last transaction came at 09:19:09 UTC, and Zilliqa disabled legacy transactions around 12:59 UTC.
The post-mortem split responsibility among the companies. Zilliqa said it wrote the original affected application implementation, while the flaw survived years of maintenance under Ledger without either party finding it. KuCoin's report exposed the active incident.
The bug is limited to the application's legacy, non-EVM signing path. Zilliqa EVM activity, recovery phrases, assets held on other blockchains through the same device, and listed software-wallet signing paths are outside the disclosed scope.
ZIL trades at $0.00283, down 0.14 percent over 24 hours, with a market cap of $56.85 million, ranking #322. The incident raises systemic questions about hardware wallet security across the crypto ecosystem, particularly for protocols relying on multi-signature schemes where biased nonce generation can expose private keys from public data alone.
This article is for informational purposes only and does not constitute investment advice.
