# Zilliqa: X-Bridge and ZRC2 token pools exploited, bridge suspended, CEO steps down · pwn.watch > Starting Oct 22 2026, attackers drained several PlunderSwap V3 pools holding ZRC2-backed tokens on Zilliqa; PlunderSwap blamed a bug in the Zilliqa node (zq2 v0.21.10) where ZRC2 transfers showed up mid-transaction but were discarded at commit, so pools paid out real assets for nothing, and put its losses at about $33.7k. On Oct 27 Zilliqa confirmed that X-Bridge and ZRC2 proxy contracts used by some liquidity pools were affected (zUSDT, SEED, kUSD and Zoge), said native ZIL and the Zilliqa EVM network were not, kept X-Bridge suspended, and said it is rotating all operational keys and working with exchanges and law enforcement. CEO Alexander Zahnd stepped down and the board took direct oversight. Zilliqa has not published a loss figure or cause. Page: https://pwn.watch/i/zilliqa-x-bridge-zrc2-exploit-oct-2026 · generated 2026-10-28T16:19:55.836Z ## Status - Severity: medium · status: live · patch: no-fix-needed - Product: Zilliqa X-Bridge and ZRC2 tokens (zUSDT, SEED, kUSD, Zoge) - Started: 2026-10-22 - Affected: Zilliqa X-Bridge; ZRC2 proxy contracts for zUSDT, SEED, kUSD and Zoge; Zilliqa node zq2 v0.21.10 (per PlunderSwap) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/zilliqa-x-bridge-zrc2-exploit-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/zilliqa-x-bridge-zrc2-exploit-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/zilliqa-x-bridge-zrc2-exploit-oct-2026.json - This file: https://pwn.watch/i/zilliqa-x-bridge-zrc2-exploit-oct-2026/llms.txt ## Updates (newest first) - 2026-10-27: Zilliqa confirms X-Bridge and ZRC2 proxy contracts were affected, keeps the bridge suspended, rotates operational keys, and announces CEO Alexander Zahnd has stepped down. (https://x.com/zilliqa/status/2115124328736215061) - 2026-10-25: Zilliqa says it has engaged an outside firm specialising in cybersecurity and AI-driven attacks to investigate; X-Bridge transactions are paused. (https://x.com/zilliqa/status/2114330935495967099) - 2026-10-22: Between 22:10 UTC Oct 22 and about 01:40 UTC Oct 23, several PlunderSwap V3 pools holding ZRC2-backed tokens are drained; PlunderSwap blames a Zilliqa node bug and puts losses at about $33.7k. (https://x.com/plunderswap/status/2113506915003330697) ## Fix brief # Security brief: Zilliqa: X-Bridge and ZRC2 token pools exploited, bridge suspended, CEO steps down Source: https://pwn.watch/i/zilliqa-x-bridge-zrc2-exploit-oct-2026 · status: live · severity: medium · updated Oct 28, 2026, 13:20 UTC ## Patch status **NO FIX NEEDED: no action on your side beyond verification.** ## What it is Starting Oct 22 2026, attackers drained several PlunderSwap V3 pools holding ZRC2-backed tokens on Zilliqa; PlunderSwap blamed a bug in the Zilliqa node (zq2 v0.21.10) where ZRC2 transfers showed up mid-transaction but were discarded at commit, so pools paid out real assets for nothing, and put its losses at about $33.7k. On Oct 27 Zilliqa confirmed that X-Bridge and ZRC2 proxy contracts used by some liquidity pools were affected (zUSDT, SEED, kUSD and Zoge), said native ZIL and the Zilliqa EVM network were not, kept X-Bridge suspended, and said it is rotating all operational keys and working with exchanges and law enforcement. CEO Alexander Zahnd stepped down and the board took direct oversight. Zilliqa has not published a loss figure or cause. Severity detail: X-Bridge suspended and four ZRC2 tokens affected; PlunderSwap reports about $33.7k drained from its pools; Zilliqa has given no total - Product: Zilliqa X-Bridge and ZRC2 tokens (zUSDT, SEED, kUSD, Zoge) ## Affected versions - Zilliqa X-Bridge - ZRC2 proxy contracts for zUSDT, SEED, kUSD and Zoge - Zilliqa node zq2 v0.21.10 (per PlunderSwap) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Latest updates - Oct 27, 2026: Zilliqa confirms X-Bridge and ZRC2 proxy contracts were affected, keeps the bridge suspended, rotates operational keys, and announces CEO Alexander Zahnd has stepped down. - Oct 25, 2026: Zilliqa says it has engaged an outside firm specialising in cybersecurity and AI-driven attacks to investigate; X-Bridge transactions are paused. - Oct 22, 2026: Between 22:10 UTC Oct 22 and about 01:40 UTC Oct 23, several PlunderSwap V3 pools holding ZRC2-backed tokens are drained; PlunderSwap blames a Zilliqa node bug and puts losses at about $33.7k. ## Advisories - [Zilliqa: An update on the recent security incidents](https://x.com/zilliqa/status/2115124328736215061) (Zilliqa) - [PlunderSwap: V3 pools holding ZRC2-backed tokens drained](https://x.com/plunderswap/status/2113506915003330697) (PlunderSwap) - [Zilliqa X-Bridge status notice](https://xbridge.zilliqa.com/) (Zilliqa) ## Write-ups & news - [Zilliqa CEO Steps Down After X-Bridge Incident](https://tsnmedia.org/zilliqa-ceo-xbridge-incident/) - [Zilliqa: Investigation with External Cybersecurity Firm Continues, CEO Alexander Zahnd Has Resigned](https://www.panews.io/articles/01a1805f-89c9-73ae-b4d5-aa29435e2490) ## Caveats Zilliqa has neither confirmed nor rejected PlunderSwap's node-bug explanation. Users should not use X-Bridge or pools with the affected tokens until Zilliqa says otherwise. Not the same as the February 2025 X-Bridge zETH/zBNB minting exploit. --- Machine-readable: https://pwn.watch/i/zilliqa-x-bridge-zrc2-exploit-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.