Zilliqa
@zilliqa
X-Bridge and ZRC2 proxy contracts used by some liquidity pools, including PlunderSwap, have been affected. The affected tokens are zUSDT, SEED, kUSD and Zoge. Native ZIL and the Zilliqa EVM network are not affected.
Plunderswap
Security incidents tagged Plunderswap. Newest first.
1 Plunderswap incident in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 6
- Longest quiet run: 2 days (Oct 23–Oct 24)
MediumZilliqa: X-Bridge and ZRC2 token pools exploited, bridge suspended, CEO steps downNo fix needed
Zilliqa X-Bridge and ZRC2 tokens (zUSDT, SEED, kUSD, Zoge) No fix needed
Starting Oct 22 2026, attackers drained several PlunderSwap V3 pools holding ZRC2-backed tokens on Zilliqa; PlunderSwap blamed a bug in the Zilliqa node (zq2 v0.21.10) where ZRC2 transfers showed up mid-transaction but were discarded at commit, so pools paid out real assets for nothing, and put its losses at about $33.7k. On Oct 27 Zilliqa confirmed that X-Bridge and ZRC2 proxy contracts used by some liquidity pools were affected (zUSDT, SEED, kUSD and Zoge), said native ZIL and the Zilliqa EVM network were not, kept X-Bridge suspended, and said it is rotating all operational keys and working with exchanges and law enforcement. CEO Alexander Zahnd stepped down and the board took direct oversight. Zilliqa has not published a loss figure or cause.
Posts 2
- Zilliqa: X-Bridge and ZRC2 token pools exploited, bridge suspended, CEO steps down
- Zilliqa: X-Bridge and ZRC2 token pools exploited, bridge suspended, CEO steps down
PlunderSwap | Zilliqa’s #1 DEX@plunderswapRoot cause: a bug in the Zilliqa node (zq2 v0.21.10), not PlunderSwap’s contracts. The attacker paid for swaps with ZRC2 tokens whose transfers showed up mid-transaction but were discarded at commit, so the pools paid out real assets and received nothing.
