Zilliqa CEO Alexander Zahnd has stepped down “at his own request”, the company announced on Tuesday evening in a thread on X posted at 16:51 UTC on 27 October. Its board has taken direct oversight, helped by an outside firm that advises on cybersecurity and governance, until a permanent leader is appointed.
By midday on Wednesday 28 October, nothing more had come from the company: no interim chief executive, no loss figure, no new post on its blog. X-Bridge, Zilliqa’s blockchain to another, usually by locking the assets on the source chain and issuing an equivalent token on the destination chain, or by using liquidity on both sides.">cross-chain bridge, is still suspended, and the company has not said since when. The exploits that drained pools on its network began on the evening of 22 October, according to PlunderSwap.
Zilliqa gave no reason for the departure beyond the CEO’s own request, and the thread does not connect it to the incidents. Nor does it name the attacker or a root cause. What it did list: X-Bridge and the ZRC2 proxy contracts used by some liquidity pools, PlunderSwap’s among them, were affected. Four tokens were hit: zUSDT, SEED, kUSD and Zoge. Native ZIL and the Zilliqa EVM network, the company said, were not affected.
Users were told not to touch X-Bridge or the affected pools until further notice. Zilliqa said it is rotating all of its operational keys and working with exchanges and law enforcement.
Because the thread went out on a European evening, much of the coverage followed overnight and on Wednesday morning. Chinese-language outlets PANews and Foresight News relayed it during the Asian morning; The Defiant reported that X-Bridge is closed in both directions and that PlunderSwap has reported losses in four token pools.
Zilliqa CEO steps down: what the thread confirms and leaves out
The thread is short: five posts, sent within three seconds of each other. It opens by saying the investigation with an external cybersecurity firm is ongoing. Two days earlier, on 25 October, Zilliqa had written on X that it had engaged a firm “specialised in cybersecurity and AI-driven attacks” to help, without naming it. The 27 October update does not name it either.
On the leadership change, the wording is plain. Zahnd stepped down at his own request; the board now runs the company directly, helped by an outside firm that advises on cybersecurity and governance. Zilliqa did not name an interim chief executive, did not say who sits on the board and did not give a date for a permanent appointment. Nothing in the statement accuses Zahnd of anything, and none of the outlets that relayed it reported otherwise.
The last post says Zilliqa will keep its focus on “the security of user funds and full transparency” and will share the latest business developments with its strategic partners LTIN and Telecom Liechtenstein. Those two partners matter to Zilliqa’s current plan: since July the company has pitched its chain as a compliance and settlement layer for regulated finance, with LTIN issuing verifiable company identifiers (vLEIs) for it.
What the thread leaves out is most of what holders want to know. There is no dollar amount for the bridge, no number of affected users, no date for X-Bridge to reopen and no word on compensation. When we checked Zilliqa’s blog on the morning of 28 October (UTC), it had no post on the incidents; its most recent entry was dated 24 September.
PlunderSwap says four pools lost about $33,700 between 22 and 23 October
The clearest account of the first exploit comes from PlunderSwap, a decentralised exchange running on Zilliqa’s EVM chain. In a warning thread posted on 23 October at 05:44 UTC, it said several of its V3 pools holding ZRC2-backed tokens were drained between 22:10 UTC on 22 October and about 01:40 UTC on 23 October.
According to PlunderSwap, the cause was a bug in the Zilliqa node software, version zq2 v0.21.10, and not its own contracts. In its description, the attacker paid for swaps with ZRC2 tokens whose transfers appeared during the transaction but were thrown away when it was committed to the chain. The pools paid out real assets and got nothing back.
Zilliqa’s own thread speaks of affected “ZRC2 proxy contracts” and does not mention the node. The two descriptions do not contradict each other, since a proxy contract runs on the node, but Zilliqa has not published a technical cause of its own, so the node bug remains PlunderSwap’s account.
PlunderSwap posted these figures in the same thread:
| Item (PlunderSwap, 23 October) | Figure |
|---|---|
| Pools directly hit (all V3) | zUSDT/WZIL 0.01%, SEED/kUSD 1%, WZIL/SEED 0.25%, ZOGE/WZIL 0.25% |
| ZIL drained from those pools | about 15 million ZIL (about $31,000) |
| Knock-on losses in other pools | about 1.3 million ZIL (about $2,700) |
| Total estimated by PlunderSwap | about $33,700 |
| Proceeds traced to one exchange hot wallet | 12.3 million ZIL |
PlunderSwap said the 12.3 million ZIL went to a single hot wallet of a centralised exchange, published the address and asked several large exchanges to identify and freeze it. Zilliqa’s thread says it is working with exchanges but does not say whether any funds have been frozen. PlunderSwap also wrote that the damaged pools cannot be repaired or redeployed on-chain, and that only a chain-level restore would put liquidity providers back where they were. It called on Zilliqa to make that a priority. The 27 October thread does not answer that request.
The dollar values are PlunderSwap’s, at the ZIL price of 23 October, and they cover the pools only. They are not a total for the whole incident.
X-Bridge is shut both ways, and nobody has published a verified bridge loss
X-Bridge links Zilliqa to Ethereum and BNB Chain. Users lock tokens on one side and receive a wrapped version, such as zUSDT, on Zilliqa. If the contracts or keys that guard the locked side are compromised, the wrapped tokens can lose their backing. Our guide to how cross-chain bridges work explains the lock-and-mint design and why it attracts attackers.
X-Bridge remains suspended, according to Zilliqa, and The Defiant reports it is closed in both directions. On 24 October, three days before Zilliqa’s update, ZilStream, a market-data site for Zilliqa, wrote on X that there were “multiple ongoing exploits” on the chain. It claimed that the bridge had been hacked, that all funds on the Ethereum side had been stolen and that this had been going on for more than two weeks. That claim is unconfirmed: Zilliqa has neither confirmed nor denied it, and it has not put a figure on the bridge.
A dollar estimate for the bridge has circulated in some news headlines. We could not find it in any statement by Zilliqa or by PlunderSwap, and no second source confirmed it, so we do not report it here. The only loss figure published by a party to the incident is PlunderSwap’s $33,700 for its pools.
One detail to keep in mind: zUSDC, the bridged USDC that Zilliqa added to X-Bridge on 5 March 2026, is not on Zilliqa’s list of affected tokens. zUSDT is.
SEED winds down, and holders of four tokens are told to stay away
The first project to draw its own conclusions was SEED. On 27 October at 13:24 UTC, three and a half hours before Zilliqa’s thread, the Kalijo account behind SEED said the token is winding down. The 22 October exploit happened at the Zilliqa network level and drained most of SEED’s liquidity, it wrote, and Zilliqa had confirmed it would not fix or restore anything SEED-related. Zilliqa has not said this in public.
SEED’s team said holders will be repaid pro rata in USDC (not zUSDC) from the project’s off-chain yield-farming funds, based on balances at a snapshot taken before the exploit, at block 38,738,522. Tokens bought after that block are not covered. The team did not say how much money is in those funds or how close the repayment comes to full value.
For the other three tokens, zUSDT, kUSD and Zoge, nobody has announced a repayment plan. PlunderSwap has put warnings across its site since 24 October and asks users not to trade or add liquidity in any smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool holding them.
Scammers are already working the story. Replies under Zilliqa’s thread pointed readers to a look-alike account offering an “eligibility” check. Zilliqa wrote in the same thread that it will never send direct messages or ask for a seed phrase or private keys. Anyone holding ZIL in self-custody has no reason to type a recovery phrase into any site to check on this incident.
Zahnd led Zilliqa for 17 months; his predecessor left in April 2025
Zahnd was Zilliqa’s chief financial officer for three years before the company named him interim CEO on 6 May 2025. He replaced Matt Dyer, who had left the chief executive role in April 2025. Zilliqa’s blog credited Dyer with leading the response to the February 2025 X-Bridge exploit and gave no reason for his exit.
Both departures came within weeks of trouble on X-Bridge. That is a matter of dates only. Zilliqa has never linked either exit to a security incident, and in Zahnd’s case it said he left at his own request. When he took over in May 2025, Zahnd said he was “honored to guide Zilliqa through this interim phase”.
With no interim chief named, the people answering for the investigation, the bridge and any compensation are, for now, the board and its outside advisers.
February 2025, July 2026, October 2026: a run of security failures
This is not Zilliqa’s first bad month. The list below sticks to what the company and the outlets cited have published, with dates.
6 February 2025: the first X-Bridge exploit
A bug in a recently added token manager contract let an attacker mint 531 zETH and 2.2133 zBNB without locking any collateral, according to Zilliqa’s post-mortem of 20 February 2025. The attacker sold 140.378 zETH on ZilSwap for about $42,000 in USDT. Zilliqa shut the relayer, paused the contracts, issued replacement tokens and reopened the bridge in a restricted form.
July 2026: theft from a partner’s cold wallet and a Ledger signing flaw
On 20 July 2026 Zilliqa said ZIL had been stolen from the cold wallet of an exchange partner it did not name, and asked exchanges to pause ZIL deposits and withdrawals, Crypto Briefing reported. Neither the amount nor the exchange was disclosed.
Around the same time, Zilliqa disabled legacy transactions to stop attackers from exploiting a signing flaw in the Zilliqa Ledger app. The company has not said in what we read whether the two events are the same one, so we keep them apart.
2 September 2026: forks, a migration tool and a vote on compensation
In a 2 September blog post, Zilliqa called the Ledger-related incident “a serious failure that cost real people real funds”. It described a hard fork that moved the ZIL of a first batch of ten exchange partners from legacy addresses to Zilliqa EVM addresses, a second fork planned for mid-September, a zero-knowledge-proof tool for self-custody holders stuck on legacy addresses, and a planned community vote on minting new ZIL to compensate victims. Legal recovery, it said, was possible but likely slow and uncertain. The post gave no amount stolen and no number of victims.
16 October 2026: Upbit and Bithumb delist ZIL
Six days before the PlunderSwap pools were drained, Zilliqa said on X it was “disappointed” that Upbit and Bithumb, two of South Korea’s largest exchanges, had decided to delist ZIL after months of exchanges with DAXA, the Korean exchanges’ self-regulatory body, over the Ledger incident. Both still let holders withdraw ZIL on Zilliqa EVM. By then Zilliqa had run a third hard fork on 5 October to move the balances of Bithumb, Bybit and Uphold to the new addresses.
The 27 October thread speaks of “recent security incidents”, in the plural. It does not say whether the October exploits have anything to do with the July events.
ZIL price barely moved on the CEO news
ZIL did not sell off after the resignation: CoinGecko’s public page showed the token slightly up over 24 hours on the morning of 28 October, with a market value of roughly $39 million.
The token was already low. After the July theft, ZIL fell from about $0.0028 to a low of $0.0024, Crypto Briefing reported at the time. On Wednesday morning it was still below that July low. None of this is a view on where the price goes next.
Open questions and what to watch next
Several answers will decide how bad this episode turns out to be:
- How much was taken through X-Bridge, and whether Zilliqa or the outside firm will publish a figure.
- Whether Zilliqa confirms PlunderSwap’s diagnosis of a node bug in zq2 v0.21.10, and whether a fixed node release follows.
- Whether any exchange freezes the 12.3 million ZIL that PlunderSwap traced to one hot wallet.
- Whether Zilliqa agrees to the chain-level restore PlunderSwap asked for, or offers another route for liquidity providers in the four pools.
- Who the board appoints as chief executive, and when, and whether the outside firms are named.
- When X-Bridge reopens, and what happens to zUSDT, kUSD and Zoge held by users in the meantime.
Further updates will come on Zilliqa’s X account, the company says. Until then, the guidance from both Zilliqa and PlunderSwap is the same. Do not use X-Bridge, and do not trade or provide liquidity in pools holding the four affected tokens.
For readers new to the topic, our glossary entry on what a cross-chain bridge is covers the basics, and our explainer on where crypto hacks really happen shows why bridges and smart contracts are hit far more often than the chains themselves.