Woofun AI reports that a critical vulnerability within the Zilliqa Ledger application compromised cryptographic security, facilitating the theft of 683,130,969.66 ZIL through the exposure of private keys. This incident, which involved entities including KuCoin and the Zilliqa EVM ecosystem, revealed a fundamental flaw in how legacy transactions were processed, leaving the newer Zilliqa EVM infrastructure untouched while legacy operations faced immediate suspension.

The scale of the breach is quantified by the exposure of 6,772 accounts, with 51 of these accounts successfully drained by attackers. These losses were executed across 66 successful attack-window transactions, marking a significant financial impact on the network. The distinction between exposed and drained accounts highlights the severity of the vulnerability, as the majority of compromised keys were identified before funds could be siphoned, yet the potential for further loss remained high until the legacy transaction path was disabled.

Structurally, the root cause lies in the application's handling of random number generation, where 40 random bytes were generated but only 32 bytes were correctly copied into the signing buffer. This error retained eight bytes of zero padding and discarded eight bytes of entropy, forcing the high 64 bits of every affected nonce to zero. Consequently, four or more biased signatures produced by the legacy Ledger application for the same account allowed attackers to reconstruct the private key from public blockchain data in seconds. While the bulk scan required at least five native signatures in a single signer era to identify victims, the mathematical exposure floor is actually four signatures, meaning accounts with exactly four signatures were initially missed by the wider scan but are now flagged by Zilliqa's live per-address checker.

Per Woofun AI, the timeline of discovery and response spans several months, with the first proven theft dated to March 4. KuCoin reported anomalous outgoing transactions from one of its cold wallets on July 19, roughly four and a half months later, signaling the active exploitation of the flaw. On July 20, the attacker's last transaction occurred at 09:19:09 UTC, prompting Zilliqa to disable legacy transactions around 12:59 UTC to halt further unauthorized access. This rapid response underscores the urgency of the situation, as the window for exploitation was closed only after significant damage had already been inflicted.

Responsibility for the incident is shared among Zilliqa, Ledger, and KuCoin, with Zilliqa acknowledging it wrote the original affected application implementation while the flaw survived years of maintenance under Ledger without detection. KuCoin's report ultimately exposed the active incident, bringing the vulnerability to light. The scope of the bug is strictly limited to the legacy, non-EVM signing path, meaning Zilliqa EVM activity, recovery phrases, assets held on other blockchains through the same device, and listed software-wallet signing paths remain unaffected. This marks a critical lesson in the importance of rigorous cryptographic validation across all legacy systems.