Attention Zilliqa users on Ledger: This is a critical vulnerability that can lead to immediate private key loss. The Zilliqa team has disclosed a severe vulnerability in its Ledger application related to random number generation in Schnorr signatures for native non-EVM transactions. Attackers can recover a signer’s private key using only publicly available on-chain data from biased random numbers. The criteria for compromise are clear: Any account that has signed and broadcast five or more native transactions via the Zilliqa Ledger app should be considered compromised. Because signatures are permanently recorded on the blockchain, updating the application afterward cannot restore security—compromised private keys must be permanently deactivated. EVM transactions and development tools such as zilliqa-js are unaffected. The root cause is a bug in the app where 32 bytes of entropy were incorrectly copied, resulting in the loss of 8 bytes of randomness. This causes the highest 64 bits of each random number to be fixed at zero. With just five or more affected signatures, attackers can compute the private key in seconds using standard hardware. Worse, the Zilliqa team observed suspected active exploitation as early as July 19 and confirmed the root cause on July 21. Zilliqa has temporarily halted native transactions to prevent further losses and is working with Ledger to release a patched version of the application. Most critical: Affected users must NOT attempt to move their assets now—doing so may allow attackers to intercept your funds. Wait for the official coordinated response plan before taking any action. Hardware wallets are not absolute safe boxes—this vulnerability originated in the official application itself.