KoinlyticsZIL news
Four DeFi breaches in one week, four different layers, one uncomfortable pattern
AFX bridge lost $24.15M to oracle abuse. Zilliqa's Ledger app leaked nonces. SecondFi's Cardano wallet exposed signing keys, draining $2.4M. Lien Finance's permissionless bond registration burned $542K. Four incidents, four layers, one blind spot in standard audits.
Zilliqa Fixed 64 Bits Of The Nonce At Zero. SecondFi Left The Secret Out Entirely. Two Chains, Same Bug Class, One Day, Seven Years Of Signatures
On July 21 and 22, 2026, two independent wallet providers disclosed the same class of bug: nonce generation broken in a way that leaks private keys through public chain data. One drained 16.1M ADA. The other exposed every ZIL Ledger signature since 2019.
SecondFi Left The Secret Out Of The EdDSA Nonce. Every ADA Signature It Ever Published Handed The Private Key To Any Chain Observer. 16.1M ADA Gone
SecondFi's Cardano wallet client derived its Ed25519 signature nonce from only the public transaction hash, omitting the secret half RFC 8032 requires. Every signed transaction leaked the private key to any chain observer. 16.1M ADA drained from 374 wallets over four events.
Zilliqa's Ledger App Fixed The Top 64 Bits Of Every Nonce At Zero For Seven Years. Five Signatures Are Enough To Recover The Private Key
Zilliqa halted native transactions on July 21, 2026 after confirming its Ledger app has generated Schnorr signatures with the top 64 bits of the ephemeral nonce fixed at zero since 2019. Five signatures are enough to recover the private key via a lattice attack.
Follow every move that matters to your bag.
Track your portfolio, LP positions and impermanent loss live. Join Koinlytics and see what moves the market before it shows on Twitter.
Join Koinlytics