News22 July, 20263 min read

Zilliqa's Ledger app leaked private keys for seven years. Ledger reviewed it twice before launch

A flaw in Zilliqa's Ledger app turned public transactions into clues for reconstructing users' private keys, despite the app going through multiple rounds of review.

Discuss this article:

Does this story need context? Notes are selected by independent community ratings, not editors.

How it works

Zilliqa, a Layer-1 blockchain, has suspended native transactions after discovering that an app designed to protect users' private keys had instead been quietly leaking enough information to reconstruct them.

The flaw affected the Zilliqa app installed on devices made by Ledger, a French hardware-wallet company, the team said in an X post on July 22.
It wasn't a breach of Ledger's underlying hardware, and Ethereum-compatible Zilliqa transactions weren't affected.

"The vulnerability affects private keys used to sign native Zilliqa transactions with a Ledger device. Any account that has broadcast approximately five or more native transactions signed through the Zilliqa Ledger app should be considered compromised."

Zilliqa

An attacker could recover an affected account's private key in seconds using only signatures permanently stored on the public blockchain. Zilliqa detected activity consistent with active exploitation on July 19 and confirmed the cause two days later.

The technical mistake was small. Every transaction signature requires a new secret random number, but although the app generated enough randomness, it copied the wrong part and replaced eight bytes with zeros.

Therefore, each transaction made another mathematical clue. After roughly five signatures, an ordinary computer could potentially piece together the private key.

The bug survived two review rounds

The flaw had been present in every released version of the app since 2019. Yet, archived Zilliqa posts reviewed by The Coinformer show that the software went through an extended review process before reaching users.

In May 2019, Zilliqa said a community developer had built the app with support from its core team and Ledger, the French hardware-wallet company, which had added Zilliqa's signature system to its device firmware.
Zilliqa said it would submit the completed app to Ledger Manager, Ledger's application platform, for review before release.
By July, Zilliqa said it had received Ledger's initial feedback and refactored the app.
A month later, it announced that Ledger had begun a second review round and verified the fixes made in response to its earlier feedback.
The app entered developer mode on Sept. 3 and was publicly released later that month, with Zilliqa telling users it looked forward to holding ZIL "safely and securely" with them.

The archived posts don't explain whether Ledger's reviews included a full examination of the cryptographic code or mainly checked compatibility and application-store requirements.

But because Zilliqa says the flaw existed in every released version, the faulty signing code evidently survived the process.

An update can't undo the damage

A software update can prevent the app from producing more weakened signatures.

But it can't erase those already recorded on-chain.

Zilliqa is therefore telling affected users not to move their funds independently since an attacker holding the reconstructed key could spot the transfer and try to beat it onto the blockchain.

"Affected accounts cannot be secured through an ordinary transfer. Because their private keys can be derived from data already recorded on-chain, an attacker with access to the same key could attempt to front-run a legitimate transfer as soon as transactions resume. Advising users simply to move their funds would therefore be ineffective and potentially unsafe."

Zilliqa

The incident is also the second exploited signing-randomness failure disclosed within a month.

SecondFi, a Cardano wallet provider, shut down after a similar flaw allowed attackers to reconstruct private keys from public transaction data and drain about 16 million ADA from 374 addresses.

Crypto Hack