Lookonchain APP

App Store

Critical vulnerability exposed in Zilliqa Ledger app; signing 5 native transactions may lead to private key leakage.

2026.07.22 20:20:29

Zilliqa has disclosed a critical random number generation vulnerability in its Zilliqa Ledger application, which impacts Schnorr signatures for native non-EVM Zilliqa transactions. Attackers can recover signers’ private keys from biased ephemeral random numbers using only public on-chain data. Any account that has signed and broadcasted approximately 5 or more native transactions via the Zilliqa Ledger app should be considered compromised. As affected signatures are permanently recorded on-chain, updating the application later will not resolve the risk—compromised private keys must be deactivated. EVM transactions and development tools including zilliqa-js, gozilliqa-sdk, and pyzil are not affected. The vulnerability stems from the app selecting the wrong 32-byte segment when copying random numbers, retaining 8 bytes of zero padding while losing 8 bytes of entropy, leading up to 64 bits of each random number being fixed to zero. Attackers can leverage 5 or more affected signatures to recover private keys in seconds using standard hardware. Zilliqa observed suspected active exploitation on July 19 and confirmed the root cause on July 21. To prevent further fund losses, Zilliqa has suspended native transactions and is collaborating with Ledger to develop a patched application. However, the patch cannot protect already exposed keys; affected users should not transfer assets on their own and must wait for official coordinated disposal plans.

Relevant content

Binance will distribute dividends for Microsoft (MSFT) and Applied Materials (AMAT) via bStocks.

According to an official announcement, Binance will distribute dividends for Applied Materials (AMAT) and Microsoft (MSFT) to users holding AMATB or MSFTB balances via its bStocks platform. After deducting applicable withholding taxes, fees, costs, and other charges, the net cash dividend will be reinvested into additional units or fractional shares of the same underlying securities. Eligible users will receive these dividends in the form of AMATB or MSFTB bStocks stock tokens. Users holding AMATB or MSFTB on-chain will receive bStocks dividends via a multiplier adjustment. Only users holding AMATB or MSFTB at the snapshot time of 08:00 (UTC+8) on August 20, 2026, will qualify for the stock dividends.

10 minutes ago

Changxin Technology's stock rose more than 10% in afternoon trading, hitting a new high since its listing.

According to market data, Changxin Technology rose more than 10% in the afternoon session, hitting a new high in its share price since listing, with a market capitalization of 4.07 trillion yuan and trading volume exceeding 23 billion yuan.

10 minutes ago

After $牛来 was listed on @Aster_DEX Perps, its price surged by over 150%. The 24-hour trading volume has reached $4.47M.

After $牛来 was listed on @Aster_DEX Perps, its price surged by over 150%. The 24-hour trading volume has reached $4.47M.

10 minutes ago

Glassnode: Bitcoin is being sidelined amid the ongoing capital rotation, as risk capital continues to flow into U.S. stocks and AI assets.

Glassnode noted in a recent post that as U.S. consumer confidence has plunged to an all-time low, U.S. stock markets have continued to hit new all-time highs, creating a stark contrast between market sentiment and asset performance. Weak consumer confidence is driving capital to accelerate shifting from cash assets to stocks, artificial intelligence (AI)-related assets, and commodities, as investors seek higher returns by allocating to risk assets. Notably, Bitcoin has been noticeably overlooked in this round of capital rotation. While stocks, AI, and commodities continue to attract inflows, Bitcoin has not benefited in tandem, indicating that current market capital allocation remains concentrated primarily on traditional risk assets and AI themes, with BTC’s participation in this round of asset rotation being relatively limited.

10 minutes ago

TD Cowen raises Berkshire Hathaway's price target from $481 to $529

TD Cowen announced it is raising its target price for Berkshire Hathaway from $481 to $529.

10 minutes ago

Hyperliquid’s USDC reserve fund revenue sharing mechanism will launch on August 26, with an expected annual contribution of $200 million for HYPE token buybacks.

Hyperliquid’s AQAv2 stablecoin model protocol has previously secured support from 19 out of 26 validators, with the mechanism’s revenue accrual set to officially launch on August 26. Meanwhile, Circle has transferred roughly $4.4 billion in USDC to Coinbase on HyperEVM via the AQAv2 mechanism, marking the largest single USDC transfer on HyperEVM to date. If all proceeds as planned, revenue generated by AQAv2 will start accruing on August 26, with the first payment expected to enter the Assistance Fund on October 3. AQAv2 (Aligned Quote Asset v2) is a stablecoin mechanism announced by Hyperliquid in May this year, allowing stablecoins not exclusively issued by Hyperliquid—including USDC—to obtain "Aligned" qualification. According to public information, AQAv2 returns most of the stablecoin revenue to the Hyperliquid ecosystem: 90% of the revenue is allocated to the relevant mechanism, and 100% of that sum is then used to repurchase and burn HYPE tokens. Coinbase is designated as the fund deployer, while Circle handles technical deployment; both parties will also stake HYPE to participate in the mechanism. Previously, the mechanism required stablecoins to be exclusive assets of Hyperliquid, but AQAv2 removes this restriction, focusing instead on HIP-4 standardized markets and perpetual contract markets operated by validators. Per public disclosures, AQAv2 is projected to generate up to approximately $200 million in revenue, further boosting token value capture through the HYPE repurchase and burn mechanism.

10 minutes ago

Popular tokens

BitcoinEthereumHyperliquidSolanaTRONBNBTetherAaveXRPPepeFartcoinOndoJupiterUniswapBonkPendleEthenaArbitrumAvalancheLidoChainlinkPolygonDogecoinCardano