Zilliqa: X-Bridge and ZRC2 token pools exploited, bridge suspended, CEO steps down
Zilliqa X-Bridge and ZRC2 tokens (zUSDT, SEED, kUSD, Zoge)
Starting Oct 22 2026, attackers drained several PlunderSwap V3 pools holding ZRC2-backed tokens on Zilliqa; PlunderSwap blamed a bug in the Zilliqa node (zq2 v0.21.10) where ZRC2 transfers showed up mid-transaction but were discarded at commit, so pools paid out real assets for nothing, and put its losses at about $33.7k. On Oct 27 Zilliqa confirmed that X-Bridge and ZRC2 proxy contracts used by some liquidity pools were affected (zUSDT, SEED, kUSD and Zoge), said native ZIL and the Zilliqa EVM network were not, kept X-Bridge suspended, and said it is rotating all operational keys and working with exchanges and law enforcement. CEO Alexander Zahnd stepped down and the board took direct oversight. Zilliqa has not published a loss figure or cause.
Why this severity: X-Bridge suspended and four ZRC2 tokens affected; PlunderSwap reports about $33.7k drained from its pools; Zilliqa has given no total
- Started
- Oct 22, 2026
Affected
- Zilliqa X-Bridge
- ZRC2 proxy contracts for zUSDT, SEED, kUSD and Zoge
- Zilliqa node zq2 v0.21.10 (per PlunderSwap)
Fixed in
No fixed release yet
Timeline3
Zilliqa confirms X-Bridge and ZRC2 proxy contracts were affected, keeps the bridge suspended, rotates operational keys, and announces CEO Alexander Zahnd has stepped down.
Zilliqa says it has engaged an outside firm specialising in cybersecurity and AI-driven attacks to investigate; X-Bridge transactions are paused.
Between 22:10 UTC Oct 22 and about 01:40 UTC Oct 23, several PlunderSwap V3 pools holding ZRC2-backed tokens are drained; PlunderSwap blames a Zilliqa node bug and puts losses at about $33.7k.
Advisories3
News & write-ups2
Posts2
X-Bridge and ZRC2 proxy contracts used by some liquidity pools, including PlunderSwap, have been affected. The affected tokens are zUSDT, SEED, kUSD and Zoge. Native ZIL and the Zilliqa EVM network are not affected.
Root cause: a bug in the Zilliqa node (zq2 v0.21.10), not PlunderSwap’s contracts. The attacker paid for swaps with ZRC2 tokens whose transfers showed up mid-transaction but were discarded at commit, so the pools paid out real assets and received nothing.
Notes & caveats
Zilliqa has neither confirmed nor rejected PlunderSwap's node-bug explanation. Users should not use X-Bridge or pools with the affected tokens until Zilliqa says otherwise. Not the same as the February 2025 X-Bridge zETH/zBNB minting exploit.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
