Zilliqa announced that CEO Alexander Zahnd has stepped down at his own request while the blockchain project investigates security incidents involving X-Bridge and certain token contracts.
In its official announcement channel, Zilliqa said its board had taken direct oversight of the organization, supported by an outside cybersecurity and governance advisory firm until a permanent chief executive is appointed.
Bridge and liquidity pools affected
Zilliqa named X-Bridge and ZRC2 proxy contracts associated with certain liquidity pools, including PlunderSwap, as affected services. The tokens identified in its statement were zUSDT, SEED, kUSD and Zoge.
The project said native ZIL and the Zilliqa EVM network were not affected by these specific incidents. The announced scope is therefore narrower than a compromise of the entire blockchain network.
Zilliqa has suspended X-Bridge and instructed users to avoid the bridge and affected liquidity pools until further notice. A final technical postmortem and verified estimate of any losses have not been provided in the statement.
Board assumes oversight amid investigation
According to the project, Zahnd’s departure was at his own request. The board is directly overseeing operations while an advisory firm helps with cyber risk and governance. An external cybersecurity company is investigating the incidents.
Zilliqa said it is rotating operational keys and coordinating with exchanges and law enforcement. It plans to share additional findings through its official channels.
Guidance for Zilliqa users
The X-Bridge incident should not be confused with Zilliqa’s separate vulnerability involving legacy Ledger transaction signing. The project maintains a dedicated incident page about that earlier issue, and its safety instructions may differ.
For now, Zilliqa’s explicit instruction is not to use X-Bridge or the affected liquidity pools. Users should also disregard anyone who requests a seed phrase or private key while claiming to represent the project.
Questions still outstanding include the technical root cause, exposure of affected assets, any recovery measures and the timetable for reopening services.
Primary source: Zilliqa official announcement, October 2026.
