A hardware wallet vulnerability that went undetected for seven years has forced Zilliqa to suspend all native transactions after attackers began exploiting the flaw on July 19. The nonce-generation bug in Zilliqa’s Ledger-signing app allowed private keys to be recovered from public signatures after roughly five on-chain transactions, according to the original report. Every version released between 2019 and 2026 was affected.
The disclosure has already triggered a sharp exchange-side response. South Korea’s Upbit designated ZIL as a cautionary asset across both its KRW and BTC trading pairs, suspended deposits and withdrawals, and warned that trading support could end entirely if the problem is not remedied quickly. The move immediately amplifies the pressure on Zilliqa’s development team, who must now contend not only with patching the flaw but also with the specter of losing one of its most important exchange listings.
How the Flaw Compromises Security
The vulnerability sits in Zilliqa’s own app for signing transactions with Ledger devices — not in Ledger’s core hardware or firmware. A nonce — a number used once — is supposed to ensure that each transaction signature is unique. When nonces are generated incorrectly, an observer who collects multiple signatures from the same private key can reconstruct the key itself. The problem is especially dangerous because it requires no malware on the user’s device; an adversary only needs to see the publicly broadcast signatures from about five native transfers. The exploit timeline suggests active exploitation began before the public advisory, raising the possibility that funds were taken before the network could react.
Zilliqa’s immediate mitigation was to halt native transactions altogether. EVM-based activity on the network is not affected, but for many long-term holders who used the app to sign with a Ledger device, retiring the compromised keys is now a necessity. That process — generating new wallets and moving assets — carries its own risks if users are not careful. Zilliqa’s own SDKs (zilliqa-js, gozilliqa-sdk, pyzil) generate nonces correctly and are unaffected. Meanwhile, the incident casts a long shadow over trust in signing integrations for lesser-known chains, where security audits may have been thinner than for Ethereum or Bitcoin.
Upbit’s Cautionary Flag and the Delisting Threat
Upbit’s cautionary asset designation is not a full delisting, but it functions as a public warning that the exchange’s risk management team sees a material threat to user funds. Korean exchanges have grown increasingly aggressive with such flags following regulatory guidance and past incidents, where failure to act quickly drew scrutiny. The parallel between this action and the broader push for exchange accountability is hard to ignore — as regulatory pressures on crypto infrastructure intensify, trading platforms have little tolerance for assets that introduce custody-layer risk.
For ZIL’s liquidity, the suspension of deposits and withdrawals on a major venue like Upbit tightens available exit routes for Korean traders. While the token remains listed for now, the warning creates a binary outcome: either Zilliqa patches the flaw and satisfies Upbit’s review, or trading is terminated. In the interim, market participants are watching whether other exchanges follow Upbit’s lead, which would compound the token’s liquidity squeeze.
What Remains Unresolved
The extent of the damage is still unclear. Neither Zilliqa nor Upbit has disclosed how many private keys were actually compromised during the exploitation window, nor what the total loss in dollar terms may be. Additionally, the fact that the flaw existed across every version of Zilliqa’s app for seven years raises questions about the chain’s overall security review process and how many other integrated apps may contain similar nonce-generation weaknesses. Developer confidence metrics have already become a yardstick for chain health, as tracked by efforts like weekly developer activity rankings, and incidents like this one can erode that confidence quickly.
For hardware wallet users, the advisory is a reminder that a Ledger device does not eliminate risk on its own — the software layer signing transactions still matters. A vulnerability in an app that signs transactions can be just as devastating as a compromised seed phrase. The Zilliqa incident will likely prompt a fresh round of audits across similar chain-specific signing integrations, particularly those with smaller developer communities where such flaws could persist without notice. Until those audits are complete, the market will have to price in the possibility that similar vulnerabilities are lurking elsewhere.
