A crypto wallet app LEAKED people's private keys for SEVEN years, and nobody noticed until last week.

Zilliqa’s Ledger app has been leaking users’ private keys for seven years.

Since 2019, the app contained a critical bug in its signature process. Instead of generating a fresh random nonce for every signature (as required for security), it copied the wrong bytes — leaving part of the nonce fixed at zero.

That small, predictable flaw was enough. Every transaction you signed leaked a little more information about your private key. After roughly five signatures, an attacker could recover the full key in seconds on a regular laptop.

The bug existed in every version of the app and went completely unnoticed until last week, when wallets started getting drained.

The damage is permanent. Those flawed signatures are immutably recorded on the blockchain. Affected users can’t safely move their funds — the attacker already has the key and will almost certainly win any race.

A hardware wallet app quietly exposed private keys in public for nearly a decade.