{"id":11102,"date":"2026-07-24T16:44:07","date_gmt":"2026-07-24T16:44:07","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=11102"},"modified":"2026-07-24T16:44:07","modified_gmt":"2026-07-24T16:44:07","slug":"a-7-year-ledger-bug-lets-attackers-rebuild-a-private-key-from-five-signatures-in-seconds","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=11102","title":{"rendered":"A 7 year Ledger bug lets attackers rebuild a private key from five signatures in seconds"},"content":{"rendered":"

<\/p>\n

\n

Zilliqa has suspended native transactions after discovering that roughly five affected signatures from the same private key may provide enough information to reconstruct that key, creating a recovery problem that an ordinary transfer cannot safely solve.<\/p>\n

The vulnerability is confined to Schnorr signatures generated for native, non-EVM transactions through the Zilliqa Ledger app, according to the network\u2019s security disclosure. Zilliqa said every version of the app released between 2019 and 2026 contained the flaw.<\/p>\n

Zilliqa said it detected on-chain activity consistent with active exploitation on July 19 and confirmed the root cause on July 21. The disclosure did not identify affected addresses or quantify any losses.<\/p>\n

Public signatures can expose the private key<\/h2>\n

The flaw occurred while the Ledger app generated the ephemeral nonce required for each native Zilliqa signature. The signing routine generated 40 bytes of randomness and reduced the result modulo the secp256k1 curve order, but then copied the wrong 32-byte range into the nonce buffer.<\/p>\n

That operation retained eight zero-padding bytes while discarding eight bytes of actual entropy, fixing the nonce\u2019s highest 64 bits at zero and leaving each value below 2192<\/sup>.<\/p>\n

Zilliqa said an attacker can combine approximately five affected signatures produced by the same private key and use lattice-reduction techniques to reconstruct that key within seconds on commodity hardware.<\/p>\n

Any account that has broadcast approximately five or more native transactions signed through the Zilliqa Ledger app should therefore be considered compromised, according to Zilliqa. The weakened signatures remain permanently available on-chain, so updating the app cannot remove the information already exposed. Affected private keys must ultimately be retired.<\/p>\n

Zilliqa credited KuCoin with reporting the incident and helping confirm the vulnerability. According to the disclosure, the exchange recovered affected private keys using publicly available signatures and assisted in tracing the problem to the app\u2019s nonce-generation code.<\/p>\n

A normal rescue transfer could be front-run<\/h2>\n

Moving assets to a new address once native transactions resume carries another risk. An attacker who has already reconstructed the private key can also sign a valid transaction and attempt to front-run the legitimate holder\u2019s transfer.<\/p>\n

This leaves Zilliqa balancing two requirements before reopening native activity: allowing legitimate users to migrate their assets while preventing attackers with the same signing authority from winning the transaction race.<\/p>\n

\n
\n
CryptoSlate Daily Brief<\/span><\/p>\n

Daily signals, zero noise.<\/h3>\n

Market-moving headlines and context delivered every morning in one tight read.<\/p>\n

5-minute digest<\/span> 100k+ readers<\/span><\/p>\n<\/div>\n

\n

Free. No spam. Unsubscribe any time.<\/p>\n

Whoops, looks like there was a problem. Please try again.<\/span><\/p>\n

You\u2019re subscribed. Welcome aboard.<\/span><\/p>\n<\/div>\n<\/div>\n<\/div>\n

The network said it was finalizing a coordinated remediation plan and advised anyone who has signed native Zilliqa transactions with a Ledger device to await official instructions before taking action.<\/p>\n

Zilliqa suspended native, non-EVM transactions as a protective measure after identifying the vulnerability. The project said the pause halted further draining of affected accounts.<\/p>\n

At publication time, Zilliqa had not announced a reopening date or published its final migration procedure through its official channels.<\/p>\n

A corrected version of the Ledger app is being prepared in coordination with Ledger and will restore full-width nonce generation. The update can prevent future signatures from exposing the same information, but it cannot secure keys compromised by signatures already recorded on-chain. Zilliqa said release details would be announced separately.<\/p>\n

EVM and official SDK signing paths are unaffected<\/h2>\n

The disclosure does not describe a compromise of Ledger hardware generally. Zilliqa attributed the vulnerability to its Ledger app\u2019s implementation of native transaction signing.<\/p>\n

Zilliqa said EVM transactions are unaffected. The nonce-generation paths used by its official zilliqa-js, gozilliqa-sdk, and pyzil software development kits also fall outside the disclosed vulnerability.<\/p>\n

\n
\"XRP\"XRP<\/div>\n
Related Reading<\/span><\/p>\n

XRP Ledger nearly shipped a feature that could drain accounts without owners signing<\/h3>\n

Averted XRPL security threat underscores the network\u2019s readiness for institutional adoption despite potential risks.<\/p>\n

Feb 28, 2026<\/span> \u00b7<\/span> Oluwapelumi Adejumo<\/span><\/p>\n<\/div><\/div>\n<\/div>\n

Crime,Featured,Hacks,Wallets#year #Ledger #bug #lets #attackers #rebuild #private #key #signatures #seconds1784911447<\/p>\n","protected":false},"excerpt":{"rendered":"

Zilliqa has suspended native transactions after discovering that roughly five affected signatures from the same private key may provide enough information to reconstruct that key, creating a recovery problem that an ordinary transfer cannot safely solve. The vulnerability is confined to Schnorr signatures generated for native, non-EVM transactions through the Zilliqa Ledger app, according to<\/p>\n","protected":false},"author":1,"featured_media":11103,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[5057,4425,1562,829,5077,353,3839,5674,321,259],"class_list":["post-11102","post","type-post","status-publish","format-standard","has-post-thumbnail","category-ethereum","tag-attackers","tag-bug","tag-key","tag-ledger","tag-lets","tag-private","tag-rebuild","tag-seconds","tag-signatures","tag-year"],"yoast_head":"\nA 7 year Ledger bug lets attackers rebuild a private key from five signatures in seconds - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=11102\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"A 7 year Ledger bug lets attackers rebuild a private key from five signatures in seconds\" \/>\n<meta property=\"og:description\" content=\"Zilliqa has suspended native transactions after discovering that roughly five affected signatures from the same private key may provide enough information to reconstruct that key, creating a recovery problem that an ordinary transfer cannot safely solve. The vulnerability is confined to Schnorr signatures generated for native, non-EVM transactions through the Zilliqa Ledger app, according to\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=11102\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-24T16:44:07+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/02\/xrp-sinkhole-1024x538.jpg\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11102\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=11102\",\"name\":\"A 7 year Ledger bug lets attackers rebuild a private key from five signatures in seconds - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11102#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11102#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/zilliqa-five-signatures-broken-lock-private-key.jpg\",\"datePublished\":\"2026-07-24T16:44:07+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11102#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=11102\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11102#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/zilliqa-five-signatures-broken-lock-private-key.jpg\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/zilliqa-five-signatures-broken-lock-private-key.jpg\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11102#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"A 7 year Ledger bug lets attackers rebuild a private key from five signatures in seconds\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto & Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"A 7 year Ledger bug lets attackers rebuild a private key from five signatures in seconds - Crypto News: Latest Cryptocurrency News and Analysis","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=11102","og_locale":"en_US","og_type":"article","og_title":"A 7 year Ledger bug lets attackers rebuild a private key from five signatures in seconds","og_description":"Zilliqa has suspended native transactions after discovering that roughly five affected signatures from the same private key may provide enough information to reconstruct that key, creating a recovery problem that an ordinary transfer cannot safely solve. The vulnerability is confined to Schnorr signatures generated for native, non-EVM transactions through the Zilliqa Ledger app, according to","og_url":"https:\/\/cryptonews.uk.com\/?p=11102","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-07-24T16:44:07+00:00","og_image":[{"url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/02\/xrp-sinkhole-1024x538.jpg","type":"","width":"","height":""}],"author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=11102","url":"https:\/\/cryptonews.uk.com\/?p=11102","name":"A 7 year Ledger bug lets attackers rebuild a private key from five signatures in seconds - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=11102#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=11102#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/zilliqa-five-signatures-broken-lock-private-key.jpg","datePublished":"2026-07-24T16:44:07+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=11102#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=11102"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=11102#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/zilliqa-five-signatures-broken-lock-private-key.jpg","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/zilliqa-five-signatures-broken-lock-private-key.jpg","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=11102#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"A 7 year Ledger bug lets attackers rebuild a private key from five signatures in seconds"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto & Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/11102","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=11102"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/11102\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/11103"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11102"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11102"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11102"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}