BTC $64,978.52 -0.82%
ETH $1,881.04 -2.26%
BNB $565.55 -0.71%
XRP $1.10 -2.61%
SOL $75.11 -3.20%
TRX $0.3313 +1.28%
DOGE $0.0693 -4.10%
ADA $0.1661 -4.62%
BCH $209.91 -2.80%
LINK $8.44 -2.06%
HYPE $58.51 -1.26%
AAVE $95.61 -1.01%
SUI $0.7301 -4.76%
XLM $0.1823 -1.37%
ZEC $501.79 -2.89%
BTC $64,978.52 -0.82%
ETH $1,881.04 -2.26%
BNB $565.55 -0.71%
XRP $1.10 -2.61%
SOL $75.11 -3.20%
TRX $0.3313 +1.28%
DOGE $0.0693 -4.10%
ADA $0.1661 -4.62%
BCH $209.91 -2.80%
LINK $8.44 -2.06%
HYPE $58.51 -1.26%
AAVE $95.61 -1.01%
SUI $0.7301 -4.76%
XLM $0.1823 -1.37%
ZEC $501.79 -2.89%

zil

All
Article
Flash

Zilliqa Ledger application exposes serious vulnerability, signing 5 native transactions may leak private keys

Zilliqa stated that there is a serious random number generation vulnerability in the Zilliqa Ledger application, affecting the Schnorr signatures of native non-EVM Zilliqa transactions. Attackers can recover the signer's private key from the biased temporary random numbers using only publicly available on-chain data.Any account that has signed and broadcasted about 5 or more native transactions through the Zilliqa Ledger application should be considered compromised. Since the related signatures are permanently recorded on the chain, subsequent updates to the application cannot eliminate the risk, and the affected private keys must be deactivated. EVM transactions and development tools such as zilliqa-js, gozilliqa-sdk, and pyzil are not affected.The vulnerability arises from the application selecting the wrong 32 bytes when copying the random number, retaining 8 bytes of zero padding and losing 8 bytes of entropy, resulting in each random number having a maximum of 64 bits fixed to zero. Attackers can use 5 or more affected signatures to recover the private key within seconds using ordinary hardware. Zilliqa observed suspected active exploitation on July 19 and confirmed the root cause on July 21.Zilliqa has suspended native transactions to prevent further loss of funds and is preparing a revised application with Ledger. However, the revised version cannot protect the exposed keys, and affected users should not transfer assets on their own but wait for the official announcement of a coordinated disposal plan.

The new Brazilian bill proposes the establishment of a permanent financial sandbox to support blockchain and tokenization testing

According to Livecoins, Brazilian Federal Deputy Lincoln Portela proposed Bill No. 2.901/2026, which aims to establish a framework for a national fintech and digital finance platform, creating a permanent regulatory sandbox system for testing blockchain technology and asset tokenization, supervised by the Central Bank of Brazil.The bill requires regulatory requirements to be proportional to the size of the company, allowing small fintech startups to apply simplified standards, and prohibits the government from imposing bureaucratic measures or obligations that do not align with the digital nature of the cryptocurrency market. The sandbox testing scope includes financial flow tracking, artificial intelligence credit applications, and programmable payment practices.The bill also allows companies to share network infrastructure and institutional adaptation databases, but they must comply with data protection regulations. The cooperation mechanism aims to combat financial crimes in cryptocurrency transactions, promote customer identity verification, and enhance cybersecurity.The bill also proposes the establishment of a national system for digital financial integrity, coordinating network regulatory actions to combat criminal structures that use cryptocurrency to hide wealth. Fines for non-compliant companies can reach up to 20% of their annual profit or revenue. The bill will be discussed in various committees of the House of Representatives.
app_icon
ChainCatcher Building the Web3 world with innovations.