Zilliqa CEO Steps Down as X-Bridge Stays Shut After Security Incidents

Zilliqa says its chief executive, Alexander Zahnd, has stepped down at his own request, as the blockchain project investigates security incidents that hit its X-Bridge and four tokens traded in liquidity pools. The board has assumed direct oversight until a permanent leader is appointed.

The announcement came in a thread on X on 27 October at 16:51 GMT, headed “An update on the recent security incidents”. The same statement went out minutes later on Zilliqa’s official Telegram announcement channel. Zilliqa has not said how much was lost, how the attacks worked or who carried them out.

What Zilliqa has confirmed

According to the statement, “X-Bridge and ZRC2 proxy contracts used by some liquidity pools, including PlunderSwap, have been affected.” It names the affected tokens as zUSDT, SEED, kUSD and Zoge. ZRC2 is Zilliqa’s token standard, and X-Bridge is the service that moved tokens between Zilliqa and other chains.

Zilliqa says “Native ZIL and the Zilliqa EVM network are not affected.” X-Bridge remains suspended, and the project has asked users to stay away from it and from the affected liquidity pools “until further notice”.

It says it is “rotating all operational keys and working with exchanges and law enforcement”, and that its “investigation with an external cybersecurity firm is ongoing”. It does not name the firm. In an earlier post on 25 October, Zilliqa said it had engaged “a leading firm from the crypto space, specialised in cybersecurity and AI-driven attacks” to help, adding: “We are taking this extremely seriously.” It has not said what kind of attack it is dealing with.

On leadership, the statement says: “The Board has assumed direct oversight, supported by an external advisory firm specialising in cybersecurity and governance, until permanent leadership is appointed.” Zahnd was named interim chief executive in May 2025, after Matt Dyer left the role, according to a Zilliqa blog post at the time. The thread does not give a reason for his departure beyond his own request, and does not link it to the incidents.

PlunderSwap’s account of the drained pools

The clearest public account of how the pools were drained comes from PlunderSwap, a decentralised exchange on Zilliqa, rather than from Zilliqa itself. In a thread on X on 23 October, PlunderSwap said that “several PlunderSwap V3 pools holding ZRC2-backed tokens were drained” between 23:10 UK time on 22 October and about 02:40 the next morning.

PlunderSwap blamed “a bug in the Zilliqa node (zq2 v0.21.10), not PlunderSwap’s contracts”. It said the attacker paid for swaps with ZRC2 tokens whose transfers appeared during a transaction but were thrown away when it was finalised, “so the pools paid out real assets and received nothing”. Zilliqa has neither confirmed nor rejected that explanation.

PlunderSwap put the value taken from its own pools at about 16.3 million ZIL, or “Total ≈ $33.7k”, including knock-on losses in other pools. That figure covers only PlunderSwap’s pools, not the X-Bridge. It said 12.3 million ZIL of the proceeds had been traced to one hot wallet at a centralised exchange, and asked exchanges to “help identify and freeze” it. PlunderSwap also said the affected pools cannot be repaired on-chain and that “A chain-level restore is the only route that returns LPs to their exact pre-attack positions”. Zilliqa has not said whether it will consider that. PlunderSwap’s website now warns users about a longer list of ZRC2-backed tokens than the four Zilliqa named.

A second blow after the Ledger flaw

This is Zilliqa’s second major security problem in four months. In July, a flaw was found in the Zilliqa app for Ledger hardware wallets: it weakened the random numbers used to sign transactions, putting private keys at risk. Zilliqa’s post-mortem, published on 20 August, records 683,130,969.66 ZIL in “proven theft”, 6,772 accounts exposed and 51 drained, and calls both figures “floors”. Zilliqa has since been retiring its legacy, non-EVM side and moving balances to Zilliqa EVM, including exchange balances through a series of hard forks.

On 16 October, Zilliqa said on Telegram that it was “disappointed by Upbit and Bithumb’s decisions to delist ZIL” after months of talks with South Korea’s exchange alliance. Zilliqa’s privacy policy is issued by Zilliqa Group Pte Ltd and benchmarked against Singapore’s Personal Data Protection Act. The project also counts Liechtenstein’s LTIN and Telecom Liechtenstein as strategic partners and says it will update them. ZIL itself has a long history: in 2023 it could still be mined alongside other coins, as TSN’s guide to dual-mining Flux and ZIL shows.

Why bridged tokens carry the risk

Zilliqa’s line that native ZIL and its EVM network are unaffected matters, but it does not help people holding the tokens that were hit. A bridged token such as zUSDT is only worth what stands behind it. If the bridge is compromised, holders may find the backing is not there. That is the pattern TSN saw when Cysic halted its bridge after an unauthorised mint, and when Initia stopped its whole chain after unbacked tokens were bridged out.

Rotating every operational key is the right step if Zilliqa suspects that any key was exposed, as Swell did after a suspected hot-key compromise. But it also suggests the investigation has not yet ruled out a key problem alongside any code bug. For liquidity providers, the hard question is PlunderSwap’s: whether their losses can be made good without a chain-level restore, which would be an unusual step for a public network. Exchange cooperation on the traced ZIL is the other route to recovery, and Zilliqa’s mention of law enforcement suggests it is pursuing it.

What holders should watch

Zilliqa has promised further updates on its official channels and warns that it “will never DM you or ask for your seed phrase or private keys”. That warning matters, because incidents like this attract fake “recovery” offers. The open questions are the size of the loss, whether the X-Bridge and pool drains share a cause, what happens to the four affected tokens, and who will lead Zilliqa next. TSN tracks cases like this on its crypto hacks and exploits hub. Until Zilliqa publishes its own findings, PlunderSwap’s thread is the only public technical account.

Sources

1. Zilliqa on X: “An update on the recent security incidents” (27 October 2026)
2. Zilliqa official Telegram announcement channel: update on the recent security incidents (27 October 2026)
3. Zilliqa on X: firm engaged to assist the investigation (25 October 2026)
4. PlunderSwap on X: thread on drained V3 pools (23 October 2026)
5. Zilliqa: Post-mortem, legacy Schnorr nonce bias (20 August 2026)
6. Zilliqa official Telegram announcement channel: Upbit and Bithumb delisting (16 October 2026)
7. Zilliqa blog: Alexander Zahnd appointed as Zilliqa interim CEO (6 May 2025)
8. Zilliqa: Global Privacy Policy

Related stories

• Cysic Halts Its Cross-Chain Bridge After Unauthorised Mint of 10 Million CYS
• How to Dual Mine Flux and Zil
• Initia Halts Its L1 and Rollups After a Security Incident