{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Zilliqa: X-Bridge and ZRC2 token pools exploited, bridge suspended, CEO steps down · updates",
  "home_page_url": "https://pwn.watch/i/zilliqa-x-bridge-zrc2-exploit-oct-2026",
  "feed_url": "https://pwn.watch/i/zilliqa-x-bridge-zrc2-exploit-oct-2026/feed.json",
  "description": "Starting Oct 22 2026, attackers drained several PlunderSwap V3 pools holding ZRC2-backed tokens on Zilliqa; PlunderSwap blamed a bug in the Zilliqa node (zq2 v0.21.10) where ZRC2 transfers showed up mid-transaction but were discarded at commit, so pools paid out real assets for nothing, and put its losses at about $33.7k. On Oct 27 Zilliqa confirmed that X-Bridge and ZRC2 proxy contracts used by some liquidity pools were affected (zUSDT, SEED, kUSD and Zoge), said native ZIL and the Zilliqa EVM network were not, kept X-Bridge suspended, and said it is rotating all operational keys and working with exchanges and law enforcement. CEO Alexander Zahnd stepped down and the board took direct oversight. Zilliqa has not published a loss figure or cause.",
  "language": "en",
  "_pwn": {
    "slug": "zilliqa-x-bridge-zrc2-exploit-oct-2026",
    "severity": "medium",
    "status": "live",
    "patchStatus": "no-fix-needed",
    "rss": "https://pwn.watch/i/zilliqa-x-bridge-zrc2-exploit-oct-2026/feed.xml",
    "llms": "https://pwn.watch/i/zilliqa-x-bridge-zrc2-exploit-oct-2026/llms.txt",
    "json": "https://pwn.watch/i/zilliqa-x-bridge-zrc2-exploit-oct-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/zilliqa-x-bridge-zrc2-exploit-oct-2026#2026-10-27-45b53d09",
      "url": "https://pwn.watch/i/zilliqa-x-bridge-zrc2-exploit-oct-2026#2026-10-27-45b53d09",
      "title": "Zilliqa: X-Bridge and ZRC2 token pools exploited, bridge suspended, CEO steps down: Zilliqa confirms X-Bridge and ZRC2 proxy contracts were affected, keeps the bridge suspended, rotates operational keys, and announces CEO Alexander Zahnd has stepped down.",
      "content_text": "Zilliqa: X-Bridge and ZRC2 token pools exploited, bridge suspended, CEO steps down: Zilliqa confirms X-Bridge and ZRC2 proxy contracts were affected, keeps the bridge suspended, rotates operational keys, and announces CEO Alexander Zahnd has stepped down.\n\nSource: https://x.com/zilliqa/status/2115124328736215061",
      "date_published": "2026-10-27T00:00:00.000Z",
      "external_url": "https://x.com/zilliqa/status/2115124328736215061",
      "tags": [
        "medium"
      ]
    },
    {
      "id": "https://pwn.watch/i/zilliqa-x-bridge-zrc2-exploit-oct-2026#2026-10-25-a2365591",
      "url": "https://pwn.watch/i/zilliqa-x-bridge-zrc2-exploit-oct-2026#2026-10-25-a2365591",
      "title": "Zilliqa: X-Bridge and ZRC2 token pools exploited, bridge suspended, CEO steps down: Zilliqa says it has engaged an outside firm specialising in cybersecurity and AI-driven attacks to investigate; X-Bridge transactions are paused.",
      "content_text": "Zilliqa: X-Bridge and ZRC2 token pools exploited, bridge suspended, CEO steps down: Zilliqa says it has engaged an outside firm specialising in cybersecurity and AI-driven attacks to investigate; X-Bridge transactions are paused.\n\nSource: https://x.com/zilliqa/status/2114330935495967099",
      "date_published": "2026-10-25T00:00:00.000Z",
      "external_url": "https://x.com/zilliqa/status/2114330935495967099",
      "tags": [
        "medium"
      ]
    },
    {
      "id": "https://pwn.watch/i/zilliqa-x-bridge-zrc2-exploit-oct-2026#2026-10-22-3d0575d9",
      "url": "https://pwn.watch/i/zilliqa-x-bridge-zrc2-exploit-oct-2026#2026-10-22-3d0575d9",
      "title": "Zilliqa: X-Bridge and ZRC2 token pools exploited, bridge suspended, CEO steps down: Between 22:10 UTC Oct 22 and about 01:40 UTC Oct 23, several PlunderSwap V3 pools holding ZRC2-backed tokens are drained; PlunderSwap blames a Zilliqa node bug and puts losses at about $33.7k.",
      "content_text": "Zilliqa: X-Bridge and ZRC2 token pools exploited, bridge suspended, CEO steps down: Between 22:10 UTC Oct 22 and about 01:40 UTC Oct 23, several PlunderSwap V3 pools holding ZRC2-backed tokens are drained; PlunderSwap blames a Zilliqa node bug and puts losses at about $33.7k.\n\nSource: https://x.com/plunderswap/status/2113506915003330697",
      "date_published": "2026-10-22T00:00:00.000Z",
      "external_url": "https://x.com/plunderswap/status/2113506915003330697",
      "tags": [
        "medium"
      ]
    }
  ]
}