Zilliqa Wallet App Leaked Private Keys for Seven Years
Security flaw puts thousands of users' funds at risk.
1Critical Security Flaw
A bug in Zilliqa's Ledger wallet app has been leaking users' private keys since 2019. Instead of generating a random nonce for each signature, the app used a fixed value. This small error allowed attackers to recover the private key after just a few transactions.
2How Was It Discovered?
The issue came to light last week when users reported drained wallets. Investigations revealed that the bug existed in all versions of the app. Security experts noted that the flaw had gone unnoticed for years, exposing users to significant risks.
3Attackers' Advantage
After just five signatures, an attacker could recover the private key in seconds using a regular laptop. Since blockchain transactions are immutable, affected users cannot safely move their funds. Attackers can drain the wallets at any time once they have the key.
4What Should Users Do?
Affected users are advised to create a new wallet and transfer their funds immediately. However, it may already be too late for accounts with leaked private keys. Experts recommend using more secure solutions like hardware wallets for storing crypto assets.
5Zilliqa's Response
The Zilliqa team issued a statement acknowledging the flaw. They released an updated version of the app and urged users to create new wallets. However, they admitted that past transactions remain at risk due to the immutable nature of the blockchain.
6A Lesson for the Ecosystem
This incident highlights the critical importance of security standards in the crypto space. Software bugs can remain undetected for years, leading to irreversible consequences. It serves as a stark warning for both users and developers to prioritize security.