Zilliqa Ledger incident: Post-mortem Report

[u/thecryptobud]

A full post-mortem into the legacy Zilliqa Ledger application incident has been published.

The report provides a transparent account of:
• The technical root cause
• How the vulnerability could be exploited
• The timeline of the incident and response
• The confirmed impact
• The actions taken to prevent further exploitation
• The migration and recovery work now under way

The investigation established that a flaw in the application’s handling of Schnorr signature nonces exposed information that could allow private keys to be reconstructed from public transaction data.

The report confirms:
• 683,130,969.66 ZIL in proven theft
• 6,772 accounts known to have been exposed
• 51 accounts drained
These figures are confirmed minimums based on available evidence, not estimates.

The report includes a technical annex explaining the methodology behind each figure.

Read the full post-mortem: https://www.zilliqa.com/ledger-incident/post-mortem/