Upbit places Zilliqa on delisting watch after critical Ledger wallet key exposure

Ledger flaw triggers exchange action

The issue stems from a critical bug in the Zilliqa Ledger app that, according to Zilliqa, has existed in every version since the app launched. The flaw reportedly zeroed out part of the random value used to protect each signature. As a result, private keys could be calculated after roughly five native transactions, allowing an attacker to take over an account in seconds using a standard computer.

Zilliqa said exploitation began on July 19. The problem was traced by KuCoin and confirmed on July 21. Because the leaked signatures remain permanently visible on-chain, the project said affected keys must be retired rather than reused.

What is affected and what is not

The disclosure applies to native ZIL transactions made through the Ledger app. Zilliqa said accounts with around five or more native transactions should be treated as compromised. In response, native ZIL transfers have been suspended.

The project also said the issue does not affect Ethereum Virtual Machine transactions or software wallets. That distinction narrows the scope of the incident, but it does not remove the risk for users who signed enough native transactions through Ledger over time.

Upbit review runs into August

Upbit has frozen deposits and withdrawals for ZIL/KRW and ZIL/BTC pairs and placed the token on a delisting watch. The move was taken under South Korea’s Virtual Asset User Protection Act, according to the source report.

The exchange’s review is expected to continue through mid-August, with the watch period running until the week of August 17. During that time, Upbit is expected to assess the impact of the vulnerability and the adequacy of the issuer’s response before deciding whether to restore normal support or end trading support for the asset.

Market pressure and recovery plan

ZIL was trading near $0.0025 at the time of the source report, after a sharp decline over both the past week and the past year. Its market capitalization was cited at about $49 million.

Zilliqa has said it will provide a recovery plan for affected balances. That promised remediation may play a role in Upbit’s eventual decision on whether the token remains listed once the review is complete.

The case brings together a wallet-level security failure, an exchange compliance response, and an unresolved question over how affected users may be made whole. For now, the immediate consequences are limited trading support on Upbit, a halt to native ZIL transfers, and a warning that previously used Ledger-based native accounts may no longer be safe.