No forecast for ZIL can be relied on right now, because the price depends on how a security crisis gets resolved. On 25 October 2026 ZIL traded at about $0.00196 and set an all-time low of $0.001941, according to CoinMarketCap. That is roughly 99% below its peak of $0.2563 on 6 May 2021. Three things will decide what happens next. First, whether holders can move their funds safely from the old Zilliqa network to Zilliqa EVM. Second, how a proposed compensation mint is settled. Third, how much trading access ZIL loses in South Korea. Most of the facts about the incident come from Zilliqa's own disclosures, so the post-mortem and recovery figures below rest mainly on a single source.
The newest development: delistings and a record low (October 2026)
- 16 October 2026: South Korea's five largest won-based exchanges announced that trading support would end for 20 tokens, Zilliqa among them, Seoul Economic Daily reported on 20 October. The paper gave falling market capitalisation and trading volume as the general reasons. TechFlow reported that one of those exchanges set the end date for ZIL trading at 16 November 2026, 14:00.
- 14 to 16 October 2026: On CoinGecko's daily data, ZIL's close fell from about $0.00333 to about $0.00251, a drop of roughly 25%. Volume then jumped to about $30 million on 17 October, against a typical $3 to 9 million.
- 25 October 2026: CoinMarketCap recorded a new all-time low of $0.001941 and a market cap of about $40 million. CoinGecko showed about $38 million.
What went wrong: the Zilliqa Ledger app flaw (July 2026)
According to Zilliqa's post-mortem, published 20 August 2026, the Zilliqa app for Ledger hardware wallets copied the wrong bytes when it built the secret random number (the nonce) used in each Schnorr signature. Eight bytes of zero padding were kept and eight bytes of real randomness were dropped, so every nonce was smaller than 2^192. With four or more such signatures, an attacker could rebuild a private key. Accounts with three or fewer signatures could not be attacked this way.
The key figures from the post-mortem:
- Scope: every released version of the app, from 2019 to 2026. Zilliqa wrote the original implementation.
- Exposure: 6,772 accounts known to be exposed, 51 drained.
- Theft: 683,130,969.66 ZIL across 66 transactions. Zilliqa calls this a floor, not a final total.
- Timeline: first proven theft on 4 March 2026. An exchange reported unusual transactions on 19 July 2026. Legacy transactions were disabled on 20 July. The fix was merged by a Ledger engineer on 27 July.
- What was not affected: Zilliqa EVM transactions, and Zilliqa's SDKs (zilliqa-js, gozilliqa-sdk, pyzil). Zilliqa says these generate nonces correctly.
The patch stops new weak signatures from being made. It does not protect keys that have already signed with the flawed app.
Where the migration stands (September 2026)
Zilliqa is retiring its legacy, non-EVM transaction layer. Zilliqa EVM will be the only production environment.
Exchange balances
A hard fork on 2 September 2026 moved balances held by a first batch of ten exchange partners from legacy addresses to their Zilliqa EVM addresses. A second exchange hard fork was planned for mid-September. Exchange users do not need to act for the protocol-level move, but deposits and withdrawals return only once each exchange finishes its own testing.
Self-custody balances
On 24 September 2026 Zilliqa published a guide to its ZKP Migration App, distributed through the project's GitHub releases page. The app computes a zero-knowledge proof on your own device. The proof shows you own a legacy zil1... account, and the funds then move to a 0x... EVM address you control. Points from the official guide:
- Check the download's SHA-256 checksum before you open the app. The guide says not to open it if the values don't match.
- The app runs natively on 64-bit Linux and on macOS. On Windows it runs through Ubuntu on WSL.
- Turn on flight mode and turn off Wi-Fi while you enter the seed phrase.
- Send the legacy balance to the escrow contract and leave about 0.5 ZIL for gas. Then submit the proof, either free through a form or with a 0-value transaction (gas typically under 2 ZIL).
- Zilliqa says it will never ask anyone to send a recovery phrase or enter it into a form. Anyone offering "migration support" and asking for a seed phrase should be treated as an attacker.
Compensation
On 2 September 2026 Zilliqa said it was preparing a community vote on a ZIL tokenomics change, including "a proposed mint of new tokens specifically to compensate impacted users." The team called legal recovery of stolen funds "slow and uncertain." No amounts, eligibility rules or vote result had been published as of that update, and none was found when this article was checked.
Does the Ledger flaw or the EVM migration affect your ZIL?
Answer three questions about where your ZIL is held and how you signed, and see which part of Zilliqa's guidance applies to you.
Where is your ZIL held right now?
- On an exchange account → No protocol action needed from you
- Already at a 0x... Zilliqa EVM address I control → Not affected by the nonce flaw
- In a legacy zil1... account I control myself → next question
Did you ever sign transactions from that legacy account with the Zilliqa app for Ledger hardware wallets?
- Yes, with the Ledger app → next question
- No, only with Zilliqa's SDKs (zilliqa-js, gozilliqa-sdk, pyzil) → Not affected by the flaw, but migration still applies
How many signatures has that account made with the Ledger app?
- Four or more → Treat the key as compromised
- Three or fewer → Not attackable this way, migrate with care
- I don't know → Treat the key as compromised
Exchange users do not need to act for the protocol-level move to Zilliqa EVM. Deposits and withdrawals return only once each exchange finishes its own testing. Separately, five South Korean won-based exchanges announced an end to ZIL trading support, with one end date reported as 16 November 2026.
Zilliqa says Zilliqa EVM transactions were not affected and generate nonces correctly. The flaw concerned legacy signatures made with the Ledger app.
Zilliqa says its SDKs generate nonces correctly. Legacy transactions are being retired, so a self-custody legacy balance moves to Zilliqa EVM through the ZKP Migration App: check the SHA-256 checksum first, leave about 0.5 ZIL for gas, and never enter your seed phrase into a form.
The post-mortem says accounts with three or fewer flawed signatures could not be attacked this way. Do not sign further from the legacy app; move the balance with the ZKP Migration App after checking its SHA-256 checksum, with flight mode on and Wi-Fi off while you enter the seed phrase.
With four or more flawed signatures an attacker could rebuild the private key, even if the funds are still in place. The patch does not protect keys that already signed with the flawed app. Zilliqa's route is the ZKP Migration App; a proposed compensation mint for impacted users has no published amounts, eligibility rules or vote result yet. Anyone asking for your seed phrase is an attacker.
This sorts Zilliqa's published guidance by your situation only: it cannot check your account's signature count, confirm whether funds were taken, or say anything about compensation terms or the ZIL price.
Background: what Zilliqa 2.0 changed (June 2025)
Zilliqa 2.0 went live in late June 2025. Zilliqa's roadmap FAQ puts the migration kickoff on 23 June 2025, and a press release dated 30 June 2025 announced the move from 1.0 to 2.0. The upgrade replaced proof-of-work with proof-of-stake and added support for Solidity contracts and EVM wallets alongside Scilla. Before launch, a six-month proto-mainnet run by 21 external validators produced more than 7.5 million blocks. The ZIL max supply is 21 billion. Circulating supply is about 20.62 billion on CoinMarketCap and about 19.51 billion on CoinGecko; the two trackers count it differently.
The project's stated direction for 2026 is a "Mediation Layer" for institutional finance, which checks whether two parties are allowed to transact before settlement. As of the 2 September update, no specific milestones had been announced for it.
What could move ZIL from here
There are no reliable price targets. Published algorithmic forecasts don't account for an unresolved key-exposure incident. These are the variables worth watching:
- Migration completion. Self-custody and exchange balances need to reach Zilliqa EVM without new losses. Each exchange that reopens ZIL deposits and withdrawals on EVM brings back some liquidity.
- The compensation vote. A new mint would increase supply and affect every holder. The size and terms will matter more than whether it passes.
- Trading access. The South Korean delisting takes effect on 16 November 2026, and that removes a large source of volume. Watch for further delistings or for restored access elsewhere.
- Further disclosures. Zilliqa describes the theft figure as a floor. A higher final number, or a second flaw, would hurt confidence further.
- Real use of the Mediation Layer. This is a longer-term factor, and nothing is measurable yet.
Risks
- Keys that signed four or more times with the flawed Ledger app should be treated as compromised, even if the funds are still in place.
- Fake migration tools and "support" accounts are a common follow-on scam after incidents like this.
- Lower liquidity after delistings can mean wider spreads and sharper moves in both directions.
- A compensation mint could dilute existing holders.
This article is information, not trading or investment advice.
Limitations: the incident and migration details come mainly from Zilliqa's own disclosures, and the price data is a snapshot from 25 October 2026.
