Zilliqa Halts Native Transactions After Ledger App Key-Recovery Bug

Key Point

Zilliqa suspended native, non-EVM transactions after discovering a Ledger app signing flaw that may let attackers reconstruct a private key from roughly five affected signatures. Zilliqa said every version of the Zilliqa Ledger app released between 2019 and 2026 contained the flaw. Zilliqa detected on-chain activity consistent with active exploitation on July 19 and confirmed the root cause on July 21. The disclosure did not identify affected addresses or quantify any losses. Zilliqa credited KuCoin with reporting the incident and helping confirm the vulnerability. Zilliqa said EVM transactions and official SDK signing paths are unaffected.

Why it matters: A wallet-signing flaw can turn past on-chain activity into a live key-compromise risk, which may disrupt transfers until safe migration is available.

Market Sentiment

Cautiously Bearish, Stress-on, Tech-driven.

Reason: Zilliqa suspended native transactions after identifying an actively exploited Ledger app signing flaw, so users may treat the event as direct infrastructure stress.

Similar Past Cases

In 2020, IOTA expected to reactivate its network by March 2 after a $2M user-wallet attack tied to Trinity wallet software. (The Block) Difference: the Zilliqa disclosure did not quantify losses and centers on exposed signatures from Ledger app native transactions.

Ripple Effect

A native-transaction pause can concentrate user activity in unaffected paths until migration instructions become clear. If Zilliqa publishes a migration procedure and native transactions reopen without fresh exploit activity, then spillover may remain mostly contained to Zilliqa users. If attackers compete with legitimate holders after reopening, then confidence in affected signing paths may weaken.

Opportunities & Risks

Opportunities: When Zilliqa publishes official migration instructions and the corrected Ledger app release, then confirmed safe migration is a potential reentry signal. Waiting for confirmation before adding exposure limits rescue-transfer risk.

Risks: If native transactions reopen before holders can retire affected keys safely, then reducing exposure limits downside from front-running risk. If Zilliqa keeps the reopening date undisclosed, then staying hedged reduces event-risk exposure.