What happened, where things stand, and where to find the detail. Newest first. We update this page as things change.
Some ZRC-2 tokens were exploited and sold into DEX pools.
An attacker used a flaw in the ERC-20 interface of some legacy ZRC-2 tokens to create tokens without backing and sold them into liquidity pools on PlunderSwap for ZIL. The native ZIL token and the Zilliqa protocol were not affected. We are working with the affected token issuers on a fix and with the exchanges where the funds ended up.
The X-Bridge was drained using a compromised key.
In early October 2026, a compromised key was used to sign unauthorised releases from the X-Bridge between Zilliqa and Ethereum. The bridge is paused and its interface is suspended. The compromised key no longer has any role on Zilliqa, and the incident has been reported to the authorities. Please do not use the X-Bridge until further notice.
Legacy signatures from the Zilliqa Ledger app could expose private keys.
A flaw in the Zilliqa Ledger app affected accounts that signed legacy, non-EVM transactions with it. Legacy transactions are paused. Being paused does not mean you are affected: check where you stand on the status page.
Found a security issue? Contact us at enquiry@zilliqa.com (see security.txt). Zilliqa will never ask for your seed phrase or private key.