Binance Migrates ZIL to Zilliqa EVM as Legacy Network Retires After 683 Million ZIL Ledger Flaw

Binance has confirmed it will migrate ZIL deposits and withdrawals from the legacy Zilliqa network to Zilliqa EVM at a 1:1 ratio, becoming the largest exchange yet to complete the retirement of the blockchain’s original Schnorr-based transaction system after a Ledger application flaw exposed thousands of accounts and led to the theft of at least 683.13 million ZIL.

By Amir Hassan | September 23, 2026

The exchange said in an announcement that ZIL will be moved from legacy Zilliqa mainnet addresses to the Zilliqa EVM network at a one-to-one ratio, with Binance handling the technical process for users who hold the token on its platform. Deposits and withdrawals through the legacy network have been suspended on Binance since August 5 at 01:00 UTC, and once the migration is complete the exchange will open ZIL deposits and withdrawals through Zilliqa EVM without issuing a separate announcement.

Spot trading, margin trading, futures and Binance Earn products involving ZIL will remain available throughout the process, the exchange added.

Why the legacy network is being retired

The migration stems from a vulnerability in Zilliqa’s Ledger application that affected native, non-EVM transactions signed with Ledger hardware devices. According to Zilliqa’s August 20 post-mortem, the application mishandled the random number, or nonce, used in Schnorr signatures: the generated data was incorrectly copied into the signing buffer, leaving the top 64 bits of each nonce fixed at zero. That collapse in randomness meant an attacker who collected several public signatures from the same account could reconstruct its private key.

The defect had been present in every released version of the Zilliqa Ledger application between 2019 and 2026. Zilliqa said the first proven theft occurred on March 4, months before the problem was detected. Suspicious activity picked up in July, and KuCoin notified the project on July 19 after finding unusual outgoing transactions from one of its cold wallets. Zilliqa disabled legacy transactions on July 20 and identified the root cause the following day.

The project later confirmed that at least 683.13 million ZIL was stolen across 66 transactions. A total of 6,772 accounts were identified as exposed and 51 accounts were drained — figures Zilliqa described as minimum confirmed totals, since additional exposed accounts could still be identified.

Crucially, EVM transactions on Zilliqa were never affected, and software wallets using supported SDKs generated nonces correctly. The recovery phrase stored on Ledger devices was also not exposed. But because signatures are stored permanently on-chain, Zilliqa concluded it could not secure private keys that had already leaked signatures — so the legacy transaction system had to go.

A migration carried out in hard-fork batches

Exchange migrations have been executed in batches because each participating platform must provide and verify its EVM wallet addresses before balances can be reassigned at the protocol level. The first exchange migration hard fork took place on September 2, moving balances held in legacy Schnorr-based wallets to EVM addresses supplied by KuCoin, MEXC, OKCoin, Binance US, Bitvavo, Korbit, Indodax, Bitrue, WhiteBIT, CoinSpot and CoinSwitch. Users holding ZIL on those exchanges were not required to take any action.

A second hard fork on September 22 covered CoinEx, HTX, Bitkub, GOPAX, Coinone, OKX, LBank, Crypto.com, Gate, Paribu, CEX.IO and Bitget. Bybit and Bithumb were expected to join a third migration fork, while Binance — which had remained outside the earlier batches — has now confirmed it will drop legacy-network support entirely and route its ZIL infrastructure through Zilliqa EVM.

Self-custody holders get a zero-knowledge route

Exchange customers are not the only holders affected. Zilliqa has built a zero-knowledge-proof migration system for users who hold ZIL in their own legacy wallets, allowing a holder to prove ownership of an old address and move the balance to an EVM address without ever sharing a seed phrase or private key. The audit of the ZKP migration tool has been completed, according to a September update, with internal testing following the security review, and its rollout was targeted for September 22 alongside an escrow contract required for the process.

The project has warned users against attempting to move funds through exposed legacy keys. Once an attacker reconstructs a private key from old signatures, both the legitimate holder and the attacker can sign transactions from the account — which is why legacy transactions were disabled for all holders, including accounts that were never exposed. Stolen balances are being handled separately from the exchange migration forks: Zilliqa is working with exchanges and law enforcement to trace the stolen assets, and its post-mortem said an exchange account used to liquidate part of the stolen funds has been identified and frozen, with the project cooperating with Singapore Police and a law firm on recovery.

The team has also proposed a community vote on tokenomics changes that could include minting tokens to compensate affected holders, with details on eligibility and mechanics to be released alongside the governance proposal.

The verdict: an accelerated end to a dual-stack era

Zilliqa’s move toward EVM infrastructure predates the incident: the network transitioned to Zilliqa 2.0 in June 2025, bringing full Ethereum Virtual Machine compatibility and proof-of-stake consensus after a six-month testing period involving 21 external validators, 7.5 million blocks processed on the proto-mainnet and 15 client upgrades. Legacy transaction support had continued alongside the EVM environment — but the Ledger incident forced a decision the project says it had already been considering, describing the legacy stack as an increasing development and security liability.

For Binance users, the practical impact is minimal: balances migrate automatically and trading continues uninterrupted. For the wider industry, the episode is a reminder that decade-old code paths in hardware wallet integrations can carry dormant, key-exposing defects — and that on-chain signatures are forever. The retirement of the legacy Zilliqa network, painful as it was, converts a slow-motion security liability into a clean, EVM-only production environment.

Market snapshot (CoinGecko, Sept. 23): BTC 85,636 USD, ETH 2,727 USD, SOL 117 USD.

Disclaimer: This article is for informational purposes only and does not constitute investment advice. Crypto assets are volatile and readers should do their own research.