A buffer-copy error in the Zilliqa Ledger app's Schnorr signing code since 2019 fixed the top 64 bits of every nonce at zero. Attackers recovered private keys from ~5 on-chain signatures using lattice reduction and stole approximately 683.13M ZIL, with exploitation first spotted on July 19, 2026.