SECURITY ALERT

The bridge is closed.

So is the corner office.

Zilliqa says its chief executive has left and its token bridge will stay suspended while an outside firm investigates last week’s exploit.

“Alexander Zahnd has stepped down as CEO at his own request,” Zilliqa said on X on Tuesday.

“The Board has assumed direct oversight, supported by an external advisory firm specialising in cybersecurity and governance, until permanent leadership is appointed.”

The departure came in the same update on the security incidents, which said an outside cybersecurity firm is still investigating.

“X-Bridge remains suspended. Please do not use X-Bridge or the affected liquidity pools until further notice,” the thread said.

Zilliqa has not given a reason for Zahnd’s departure beyond his own request, and has not published a loss figure.

What happened, in UTC

  • Thursday 22 Oct, 22:10. Several PlunderSwap V3 pools holding ZRC2-backed tokens start to be drained, PlunderSwap said. ZRC2 is Zilliqa’s token standard.
  • Friday 23 Oct, ~01:40. The draining stops, by PlunderSwap’s account.
  • 05:44. PlunderSwap warns users not to trade in or add liquidity to the affected pools.
  • Sunday 25 Oct, 12:19. Zilliqa says it has hired a firm specialised in “cybersecurity and AI-driven attacks”.
  • Tuesday 27 Oct, 16:51. Zilliqa posts its update: X-Bridge suspended, keys being rotated, CEO gone.

So what exactly broke?

Affected, and not

Zilliqa says X-Bridge and the ZRC2 proxy contracts used by some liquidity pools, including PlunderSwap’s, were affected.

The tokens it names are zUSDT, SEED, kUSD and Zoge.

Native ZIL and the Zilliqa EVM network are not affected, it says.

The X-Bridge app carries a banner: “Due to a recent security incident with xBridge, all incoming and outgoing transactions are paused.”

Zilliqa says it is rotating every operational key, and that it is in contact with law enforcement and with exchanges.

How much was taken?

Claimed, not confirmed

The only loss figure comes from PlunderSwap, not Zilliqa.

PlunderSwap says about 15 million ZIL, roughly $31,000, was drained from four pools: zUSDT/WZIL, SEED/kUSD, WZIL/SEED and ZOGE/WZIL.

It counts about 1.3 million ZIL, roughly $2,700, in knock-on losses. That makes about $33,700.

PlunderSwap blames a bug in a version of the Zilliqa node software, zq2 v0.21.10. ZRC2 transfers appeared mid-transaction but were discarded when the transaction was committed, it says.

It says 12.3 million ZIL has been traced to a single exchange hot wallet, and it has called for a chain-level restore.

Zilliqa has not confirmed that root cause or responded publicly to the restore call.

Larger figures circulating on social media are unverified. CryptoWatchDesk is not using them.

Bridged-token bugs have stopped bigger chains this month, as Initia’s chain halt over a bridged-token bug showed.

If ZIL itself is safe, where is the risk now?

The risk is the follow-up

Incidents bring impostors. This week’s Predict.fun’s loss of about 400,000 USDT was blamed on a third-party-hosted docs site.

“We will never DM you or ask for your seed phrase or private keys,” Zilliqa said.

Protect yourself

  • Do not use X-Bridge or the affected PlunderSwap pools until Zilliqa and PlunderSwap say they are safe.
  • Holders of zUSDT, SEED, kUSD or Zoge should check official channels before moving them.
  • Ignore any direct message offering refunds, “recovery” or a claim link.
  • Never share a seed phrase or what a private key is. No project needs it.
  • Revoke old token approvals for the affected pools from a wallet you trust.

When the chief executive leaves mid-investigation, who signs off on the all-clear?

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.