Critical vulnerability exposed in Zilliqa Ledger app; signing 5 native transactions may lead to private key leakage.
Zilliqa has disclosed a critical random number generation vulnerability in its Zilliqa Ledger application, which impacts Schnorr signatures for native non-EVM Zilliqa transactions. Attackers can recover signers’ private keys from biased ephemeral random numbers using only public on-chain data. Any account that has signed and broadcasted approximately 5 or more native transactions via the Zilliqa Ledger app should be considered compromised.
As affected signatures are permanently recorded on-chain, updating the application later will not resolve the risk—compromised private keys must be deactivated. EVM transactions and development tools including zilliqa-js, gozilliqa-sdk, and pyzil are not affected.
The vulnerability stems from the app selecting the wrong 32-byte segment when copying random numbers, retaining 8 bytes of zero padding while losing 8 bytes of entropy, leading up to 64 bits of each random number being fixed to zero. Attackers can leverage 5 or more affected signatures to recover private keys in seconds using standard hardware.
Zilliqa observed suspected active exploitation on July 19 and confirmed the root cause on July 21. To prevent further fund losses, Zilliqa has suspended native transactions and is collaborating with Ledger to develop a patched application. However, the patch cannot protect already exposed keys; affected users should not transfer assets on their own and must wait for official coordinated disposal plans.
8 minutes ago
Wintermute: Crypto markets have performed relatively strongly this week, but the uptrend has not yet been confirmed.
Wintermute’s market analysis states that June’s U.S. Consumer Price Index (CPI) fell 0.4% month-over-month, marking the largest single-month decline since April 2020. The overall inflation rate dropped from 4.2% to 3.5%, below the market’s expected 3.8%. Markets have priced out the possibility of a July interest rate hike by the U.S. Federal Reserve, but renewed U.S. sanctions on Iran and the resumption of port blockades pushed Brent crude up 15.54% for the week. Risk assets showed clear divergence: Ethereum (ETH) rose 3.64%, Bitcoin (BTC) gained 1.46%, while the Nasdaq Composite index fell 4.16%. Following the U.S. CPI release, Bitcoin briefly surged from around $62,000 to $64,900, and ETH jumped as much as 7% to $1,884, triggering roughly $134 million in short-position liquidations within an hour. U.S. spot Bitcoin ETFs saw a combined net inflow of approximately $191 million on Tuesday and Wednesday, ending a 10-day streak of net outflows. However, compared to June’s record $4.5 billion net outflow, the current inflow scale remains insufficient to confirm a sustained trend. Bitcoin held onto its post-CPI gains amid a sell-off in chip stocks, indicating the crypto market structure is repairing but has not yet formed a definitive upward trend. Wintermute believes that if spot Bitcoin ETFs maintain net inflows for a consecutive week and Bitcoin trades above $66,000 for several sessions, the market’s relative strength signal will be confirmed. This assessment could be invalidated if Brent crude breaks above $90 or the Strait of Hormuz is officially closed.
8 minutes ago
In U.S. pre-market trading, the semiconductor, storage, and optical communications sectors all fell across the board, with SK Hynix ADR dropping more than 6%.
According to BIT (bit.com) market data, U.S. stocks saw all-round declines in the semiconductor, storage and optical communications sectors during pre-market trading on Wednesday. Semiconductor stocks were broadly lower: Lam Research (LRCX) fell 3.57%, Intel (INTC) dropped 3.51%, Applied Materials (AMAT) declined 3.44%, and Arm (ARM) slid 3.01%. The storage sector led losses, with SK Hynix (SKHY) down 6.57%, Micron Technology (MU) falling 3.76%, Western Digital (WDC) dropping 3.59%, SanDisk (SNDK) declining 3.38%, and Seagate Technology (STX) sliding 3.13%. Optical communications-related stocks also trended lower: Astera Labs (ALAB) fell 3.94%, Applied Optoelectronics (AAOI) dropped 3.38%, Coherent (COHR) declined 3.23%, Credo (CRDO) slid 2.93%, and Lumentum (LITE) fell 2.84%.
8 minutes ago
The three major US stock index futures fell across the board, with Nasdaq 100 futures dropping more than 1%.
According to market data from BIT (bit.com), the three major U.S. stock index futures fell collectively: Nasdaq 100 Index futures dropped more than 1%, S&P 500 Index futures fell 0.38%, and Dow Jones Index futures fell 0.22%.
8 minutes ago