- The crypto community continues to criticize Zilliqa (ZIL), a public layer-1 high-performance blockchain, over its response to the recent platform exploit.
- Many people appear dissatisfied with the reported sluggish recovery efforts and the lack of transparency.
Zilliqa Hires Cybersecurity Firm to Investigate Hacking Incident
On Sunday, the Zilliqa core team said it had engaged a leading firm from the crypto industry, specializing in cybersecurity and AI-driven attacks, to assist in investigating the situation. The company, which the team has not yet named, was expected to help examine the matter.
To our community: Zilliqa has engaged a leading firm from the crypto space, specialised in cybersecurity and AI-driven attacks, to assist us in investigating the situation.
We are taking this extremely seriously.
— Zilliqa (@zilliqa) October 25, 2026
Despite these assurances, some people claiming to have invested in Zilliqa’s token criticized the core team for moving slowly to investigate an exploit that had already been publicly known since July 19, 2026, following KuCoin’s discovery. They pressed for greater urgency.
Others urged the group to be more specific about its progress in recovering affected holders’ assets and to acknowledge that the project had failed.
The 683.13 Million ZIL Heist
The community’s growing frustration stems from a series of hacking incidents that occurred on Zilliqa’s ledger over the past seven months. An on-chain investigation confirmed that hackers had already stolen 683.13 million ZIL across 66 transactions. The inquiry also exposed 6,772 customer accounts on the ledger.
KuCoin flagged the asset after noticing anomalous outgoing transactions from one of its cold wallets. The global crypto exchange later said its analysts found that Zilliqa-related thefts had been occurring since March 4 of this year.
Between KuCoin’s disclosure and now, the stolen assets totaled roughly $1.3 million to $3.21 million. The figures may be higher, since the vulnerability had existed since Zilliqa’s mainnet launched in 2019.
The Cause and Fix
Without going into technicalities, the Zilliqa core team explained that the exploit allowed attackers to recover users’ private keys directly from on-chain signatures without physical access to a hardware device or seed phrase. It originated from a bug that caused a critical signing flaw in the ledger’s hardware wallet app, where improper nonce padding significantly reduced entropy. For context, in Web3, entropy refers to the raw, unpredictable randomness used to generate secure cryptographic wallet seed phrases and private keys.
A Zilliqa engineer patched the issue by correcting a single line of code and restoring full-width nonce generation. After that, the team opened a pull request against the ledger’s repository for the application on July 24 and merged it into the network three days later.
Zilliqa warned, however, that the fix does not restore the safety of keys that users had already signed. As a result, addresses linked to them remain permanently vulnerable, and the only way to protect users is to retire them completely and migrate their assets elsewhere.
