Upbit has placed Zilliqa (ZIL) on its delisting watchlist after a critical flaw in the Zilliqa Ledger app was found to expose users' private keys. The vulnerability, which zeroed out part of the random number protecting each signature, allowed attackers to derive private keys after about five native transactions. Exploitation began on July 19, and by July 20 an exchange partner reported stolen ZIL from a cold wallet.
The Ledger flaw and its impact
The bug was first spotted when an exchange partner flagged stolen ZIL from a cold wallet on July 20. KuCoin helped trace the issue, and by July 21 the flaw was confirmed. Zilliqa stated that any account with five or more native transactions signed through the Zilliqa Ledger app should be considered compromised. Because leaked signatures remain on-chain forever, affected keys must be retired permanently. Native ZIL transfers are currently suspended, though Ethereum Virtual Machine (EVM) transactions and software wallets remain safe.
Upbit's response under Korean law
Upbit acted under Korea's Virtual Asset User Protection Act, which took effect in 2024. The exchange placed risk tags on both the ZIL/KRW and ZIL/BTC trading pairs. Deposits and withdrawals have been frozen since July 20, and the review period runs until the week of August 17. The delisting watch is a formal step that could lead to full removal of the token from the platform.
What ZIL holders should do
Anyone who used the Zilliqa Ledger app for native transactions should assume their keys are compromised. Zilliqa has promised a recovery plan for affected balances, but details have not been released. In the meantime, users are advised to move funds to software wallets or EVM-based accounts, which are not affected by the flaw. The exchange freeze means no ZIL can be moved in or out of Upbit until the review concludes.
The review runs until the week of August 17, after which Upbit will decide whether to delist ZIL entirely. Zilliqa has promised a recovery plan for affected balances, though specifics remain scarce. For now, the token's fate on one of the largest Korean exchanges hangs in the balance.
