Mentioned in This Article
1. Zilliqa CEO steps down: what the project announced
Alexander Zahnd has stepped down as chief executive of Zilliqa, the layer-1 blockchain said in a post on X on October 27, while the project investigates security incidents on its cross-chain bridge, X-Bridge. The bridge remains suspended, four tokens have been named as affected, and Zilliqa has not disclosed a loss figure or named a successor.
A fuller update posted to the project's Telegram channel said Zahnd left at his own request. The board of directors will oversee the company directly until permanent leadership is appointed, and an outside firm that advises on cybersecurity and governance is supporting that oversight. The announcement did not say how long the search for a new chief executive might take, nor whether Zahnd will keep any formal role at the project.
The timing matters as much as the departure itself. The resignation landed in the middle of an active investigation, with the bridge shut and users being told to stay away from certain liquidity pools. For a network that relies on partners, exchanges and developers trusting its infrastructure, losing its top executive at this moment leaves a visible gap in public accountability, even though the board has said it is stepping in.
It is also the second time Zilliqa has lost its chief executive since April 2025. That history, covered in more detail below, shapes how the market and the project's partners are likely to read the latest change.
2. Which tokens and contracts were affected?
Zilliqa says the incidents reached X-Bridge, its cross-chain bridge, and a set of ZRC2 proxy contracts on which some liquidity pools depend. Pools run by PlunderSwap, a decentralized exchange on Zilliqa, are among those that rely on the affected contracts.
The project named four tokens as affected: zUSDT, SEED, kUSD and Zoge. It was equally specific about what was not hit. In its words, native ZIL and the Zilliqa EVM network are not affected. That distinction is important for holders, because it separates the chain's own asset and its Ethereum-compatible execution environment from the bridged and proxy-based tokens that circulate on top of them.
A proxy contract is a piece of code that stands in front of another contract and forwards calls to it. Liquidity pools that accept a token through such a proxy depend on the proxy behaving as expected. If the proxy or the bridge that feeds it is compromised, the tokens passing through it can stop being reliable, even when the base chain keeps producing blocks normally.
Zilliqa has not said how the incidents unfolded technically, and it has not described whether the bridge and the proxy contracts were attacked together or separately. The statements so far focus on scope and containment rather than on the mechanics of the breach.
3. How much was lost in the X-Bridge incident?
Zilliqa has not put a number on the losses. That silence is one of the central open questions in the episode, and it leaves the most concrete figure to come from a third party rather than from the project itself.
PlunderSwap said in a notice on its website that roughly $800,000 was stolen from X-Bridge. The exchange also said that zUSDC, zUSDT, zWBTC and XCAD, which reached Zilliqa through the bridge, have lost their backing. It has removed those tokens from its token list. The $800,000 estimate is PlunderSwap's own and has not been confirmed by Zilliqa.
The two lists of tokens are not identical. Zilliqa's list names zUSDT, SEED, kUSD and Zoge, while PlunderSwap's notice refers to zUSDC, zUSDT, zWBTC and XCAD. Only zUSDT appears on both. Zilliqa has not explained the difference, and it is not clear whether the lists describe different stages of the same incident or different assessments of the same damage.
Until Zilliqa publishes its own accounting, users holding any of these assets face real uncertainty. A token that has lost its backing no longer represents a claim on the asset it was meant to mirror, which is why a decentralized exchange would delist it from its default list.
4. What has Zilliqa done in response?
The bridge remains suspended. Zilliqa has asked users to avoid both the bridge and the affected pools until further notice, a request that stays in force because the project has not said when X-Bridge will reopen.
The company says it is replacing every operational key, a step that signals concern about the security of the credentials used to run the bridge and related infrastructure. Replacing keys is a standard containment measure after a suspected compromise, because any key an attacker may have seen cannot be trusted afterward.
Zilliqa also says it is in contact with exchanges and with law enforcement. Contacting exchanges is usually meant to help flag or freeze stolen funds if they are moved to trading venues, while a law enforcement report creates a formal record and can support later recovery efforts. The project has not said whether any funds have been traced or frozen.
The response began before the CEO announcement. On October 25, Zilliqa first said it had hired an outside firm that specializes in cybersecurity and AI-driven attacks to help investigate. The firm's involvement suggests the project wants independent analysis of how the incident happened, though no findings have been released.
Taken together, these steps describe a project in containment mode rather than recovery mode. Replacing keys, engaging investigators and notifying exchanges and authorities all aim to limit further harm and preserve evidence. None of them restores the affected tokens or reopens the bridge, which is why users are still being told to wait. Zilliqa has promised no date for the next update, so the pace of disclosure will depend on what the outside firm finds and on what the board decides to share.
5. Why bridge problems spread into token pools
Cross-chain bridges let users move assets between blockchains. A common design locks the original asset on one chain and issues a representative token on another, so the representative token is only as sound as the reserves and the bridge logic behind it.
That structure explains why a bridge incident reaches well beyond the bridge. Any pool that holds a bridged token is exposed, because traders and liquidity providers are relying on the token being redeemable for the underlying asset. When that assumption fails, the token can lose value or become untradeable, and the pools that hold it can be left with assets that are worth far less than their listed prices.
Bridges have been a recurring weak point across the industry because they concentrate value and depend on a small set of keys, contracts and operational processes. That is also why the focus on replacing operational keys and on outside investigators is consistent with how projects typically react to such events.
For Zilliqa, the practical question is whether the damage stays contained to the named tokens and pools. The project's statement that native ZIL and the EVM network are unaffected suggests the chain itself continues to function, but the tokens that depend on the bridge may take longer to settle, and their holders are the ones waiting on answers.
6. A second leadership change since April 2025
Zahnd was previously Zilliqa's chief financial officer. He was appointed interim CEO in May 2025, following the departure of Matt Dyer as chief executive in April 2025. His exit therefore makes him the second chief executive to leave since April 2025, and the project once again has no named permanent leader.
Dyer's departure followed an earlier X-Bridge exploit in February 2025. According to Zilliqa, a bug in a token manager contract allowed an attacker to pull out about $42,000 in USDT. That incident was far smaller than the roughly $800,000 PlunderSwap now attributes to the current one, but it involved the same bridge.
The project has had other security trouble this year. In July, Zilliqa halted native transactions because of a flaw in a Ledger app that it had built, which exposed private keys. Taken together, the February exploit, the July halt and the present incidents form a pattern that the market is likely to weigh when judging how well the project manages risk.
Repeated leadership changes can also complicate recovery. A project dealing with a security incident benefits from a single accountable executive who can speak for it to users, exchanges and regulators. With the board now overseeing operations directly, those responsibilities rest with a group rather than one named person.
7. What's next for Zilliqa and ZIL holders
Several answers are still missing: the amount lost, the identity of the permanent chief executive and the date on which X-Bridge will reopen. Zilliqa has not offered a timeline for any of them.
The project said it would brief its strategic partners, LTIN and Telecom Liechtenstein, on business developments. It did not describe what those developments are, but the commitment indicates that partner confidence is a priority during the transition.
On the market side, ZIL traded at $0.001999 at 4:52 p.m. ET on October 28, according to CoinGecko data, and the price was roughly flat over the previous 24 hours. The muted reaction fits the project's message that the native token is not directly affected, though it does not settle the longer-term questions about leadership and bridge security.
For now, users are advised to keep away from X-Bridge and the affected pools. The next signals to watch are an official loss figure, the results of the outside investigation, the appointment of a permanent chief executive and any announcement on restoring the bridge.