Zilliqa Announcement

📢Reminder: Time is running out to bridge your USDC via deBridge. If you haven’t done so yet, please bridge out as soon as possible. deBridge will sunset on 31 March 2026. More info available here : https://blog.zilliqa.com/strengthening-stablecoin-infrastructure-on-zilliqa-introducing-zusdc-via-xbridge/

Trade ZIL. Climb the leaderboard. - A $20K competition is live on Variational Perp DEX - ranked by PnL and volume. - Runs until Apr 18, 00:00 UTC. - Variational is in beta - use code ZILLIQA to get started. https://x.com/variational_io/status/2040152011572998180 ⚠️ Disclaimer: Perpetual trading carries high risk and is not suitable for everyone. Make sure you understand how leverage works and trade responsibly.

Zilliqa mainnet will undergo a scheduled upgrade with the release of v0.21.0, introducing improvements to performance, security, and validator infrastructure. Key upgrades: • State pruning for better storage efficiency • RANDAO support for improved randomness in consensus • Deposit contract upgrade (deposit_v8) • Flexible checkpoint versioning for smoother recovery and upgrades Upgrade timeline (mainnet): • Deposit_v8 activation - Block 25,902,000 (~May 5, 08:37 UTC) • RANDAO activation - Block 25,905,600 (~May 5, 09:49 UTC) Validators and node operators have already been notified and have upgraded ahead of these block heights. If any validator has not upgraded yet, please do so at earliest. Community: No action is required. Funds remain SAFU. More details: https://github.com/Zilliqa/zq2/releases/tag/v0.21.0

Nonce-Generation Vulnerability in the Zilliqa Ledger App A critical vulnerability has been identified in the Zilliqa Ledger application affecting the generation of Schnorr signatures for native (non-EVM) Zilliqa transactions. The vulnerability causes signatures to be generated with a predictably weakened ephemeral nonces, from which an attacker can recover the signer’s private key using only publicly available on-chain data. Protective measures are already in place to prevent further loss, and a coordinated remediation plan is being finalised. Users who have signed native Zilliqa transactions with a Ledger device should await official guidance before taking any action. Impact The vulnerability affects private keys used to sign native Zilliqa transactions with a Ledger device. Any account that has broadcast approximately five or more native transactions signed through the Zilliqa Ledger app should be considered compromised. Its private key can be reconstructed from signatures already recorded on-chain, regardless of any subsequent software update. The issue is confined to the Ledger app’s native signing path. EVM transactions are unaffected. Zilliqa software development kits, including zilliqa-js, gozilliqa-sdk and pyzil, generate nonces correctly and are not affected. Root cause Zilliqa native transactions are authenticated using EC-Schnorr signatures over secp256k1. Each signature requires a fresh, uniformly random 256-bit ephemeral nonce, (k). The secrecy and full-width randomness of (k) are essential, as any systematic bias can allow the private key to be recovered. The signing routine generated 40 bytes of randomness and reduced them modulo the curve order, correctly producing a uniform 256-bit value. However, when copying this value into the nonce buffer, the code copied the wrong 32 bytes of the 40-byte output. This retained the eight zero-padding bytes introduced by the reduction and discarded eight bytes of entropy. As a result, the most significant

We have published a dedicated Ledger Incident Hub with the latest confirmed information on the signing flaw affecting the Zilliqa Ledger application for Legacy accounts. Legacy Zilliqa transactions remain paused as a precaution. Zilliqa EVM is not affected. The hub explains: • what happened • who may be affected • what is currently paused • what action users should take • how the recovery work is progressing You do not need to take any action right now. The Zilliqa team will never contact you first or ask for your seed phrase, private key or recovery phrase. Read the Incident Hub: https://www.zilliqa.com/ledger-incident/

Zilliqa Ledger incident: the recovery and transition plan is published Read the full plan: zilliqa.com/ledger-incident/ - The legacy (non-EVM) side of Zilliqa is being retired, with recovery taking place through migration to Zilliqa EVM. - Legacy balances do not expire, and nothing is forfeited by waiting. - No migration tool has been released yet. - No part of the published plan includes a cut-off date. - Legacy transactions remain paused, and no action is required at this time. Beware of impersonators and scammers sharing phishing links or inviting you to groups that appear official. Zilliqa team will never contact you first or ask for your recovery phrase.

Progress update: 12/08/2026 • The address checker is now live. Enter your legacy Zilliqa address (Zil1...) to check whether it was affected or may be vulnerable. • The migration tool is expected to undergo an external security audit over the next two weeks, with the report targeted for early September. A launch date will follow once the findings have been reviewed. • Several exchanges have confirmed support for the migration. We are targeting the first batch of exchange migrations by the end of August, enabling participating exchanges to work towards resuming ZIL deposits and withdrawals on Zilliqa EVM. • Efforts to trace the stolen funds continue with legal authorities, exchange partners and other relevant parties. We cannot share further details while the investigation is ongoing. Check your address and read the full update: https://www.zilliqa.com/ledger-incident/

A full post-mortem into the legacy Zilliqa Ledger application incident has been published. The report provides a transparent account of: • The technical root cause • How the vulnerability could be exploited • The timeline of the incident and response • The confirmed impact • The actions taken to prevent further exploitation • The migration and recovery work now under way The investigation established that a flaw in the application’s handling of Schnorr signature nonces exposed information that could allow private keys to be reconstructed from public transaction data. The report confirms: • 683,130,969.66 ZIL in proven theft • 6,772 accounts known to have been exposed • 51 accounts drained These figures are confirmed minimums based on available evidence, not estimates. The report includes a technical annex explaining the methodology behind each figure. Read the full post-mortem: https://www.zilliqa.com/ledger-incident/post-mortem/

Exchange migration hard fork scheduled: The first hard fork for the migration of Centralised exchange balances is scheduled for block height 34,844,968, with an estimated activation time of 2 September 2026 at approximately 12:58 UTC. It will migrate the ZIL balances held in participating exchanges’ legacy Schnorr-based wallets to the new Zilliqa EVM wallet addresses provided and verified by each exchange. The following Exchanges included in the first hard fork: KuCoin MEXC OKCoin Binance US Bitvavo DigitalX (Korbit) Indodax Bitrue WhiteBIT CoinSpot CoinSwitch We remain in contact with the remaining exchanges, including Binance, Upbit, Bithumb, Coinone and GOPAX. We aim to include remaining exchanges in subsequent hard forks to complete the ZIL migration for exchange partners. Deposits and withdrawals: Once the hard fork is active and balances have been successfully migrated, exchanges included in this first batch are expected to begin restoring ZIL deposits and withdrawals on Zilliqa EVM. Timelines will vary, so please follow each exchange’s official channels for updates. Note: Balances identified as having been stolen by the attacker will not be restored through this hard fork. Efforts to trace and recover the stolen funds continues in coordination with the appropriate legal authorities, exchange partners and other relevant parties.