Zilliqa CEO Alexander Zahnd steps down amid X-Bridge security probe and $800K exploit. Phemex News 2026/10/28 00:42 Zilliqa CEO Alexander Zahnd has stepped down as the company faces a security investigation into its X-Bridge cross-chain infrastructure. The board has assumed oversight during the probe, while X-Bridge remains paused in both directions to mitigate further risks. Security firm PlunderSwap estimates that approximately $800,000 was stolen from the X-Bridge protocol during the exploit. The shutdown affects all bridge transfers until the vulnerability is fully assessed and resolved. Disclaimer: The content provided on Phemex News is for informational purposes only. Phemex do not guarantee the quality, accuracy, or completeness of the information sourced from third-party articles. The content on this page does not constitute financial or investment advice. Phemex strongly encourage you to conduct you own research and consult with a qualified financial advisor before making any investment decisions.

Zilliqa launches address checker ahead of August migration. Exchange migrations planned as Ledger incident recovery continues. Reading Time: 3 mins read Zilliqa has activated an address checker as part of its ongoing recovery efforts following a Ledger-related security incident and the transition toward Zilliqa EVM. The new tool is intended to give users a way to verify relevant wallet information as the network prepares for a broader migration process. The move comes as an audit of Zilliqa's migration tool is set to begin. The audit is expected to provide an additional security review before the tool is used more widely to facilitate the transfer of assets and accounts during the recovery process. Zilliqa is also coordinating with several cryptocurrency exchanges, with the first group of exchange migrations targeted for completion by the end of August. The staged approach is designed to allow the network and participating platforms to validate the migration process before expanding it to a larger number of users. The address checker is now live, while an independent audit of the migration tool is being initiated to strengthen safeguards before the recovery and migration process expands. Address checker supports user verification. The launch of the address checker represents an early step in Zilliqa's recovery strategy. Users affected by the Ledger incident can use the tool to check address-related information connected with the migration process. Such verification is particularly important during a network recovery because users need confidence that their assets and wallet details are being associated with the correct addresses before migration activity begins. The checker also provides a mechanism for users to review information before taking further action. This can help reduce the risk of errors during a period when blockchain infrastructure and account records are being transitioned. The latest development follows Zilliqa's efforts to recover from the Ledger incident and restore normal operations involving Zilliqa EVM. The incident has required the network to introduce additional controls while examining the movement and status of potentially affected funds. Migration tool undergoing security review. Zilliqa said an audit of its migration tool is about to get underway. The review is an important component of the recovery process because the tool will play a central role in moving users and assets through the planned migration framework. A formal audit can help identify weaknesses before the migration tool is used at scale. It can also provide additional assurance to exchanges and users that the process has been reviewed for potential security issues. Several exchanges have already been confirmed as participants in the migration process. The first batch is being targeted for completion by the end of August, although the broader migration is expected to proceed in stages. The phased exchange migration is intended to provide a controlled path for platforms to transition while Zilliqa continues its security checks and recovery work. Stolen funds investigation continues. The migration effort is taking place alongside an investigation into funds associated with the Ledger incident. The continued probe is expected to remain an important part of Zilliqa's recovery strategy as the network works to establish the status of affected assets. The stolen funds investigation adds another layer of complexity to the migration. Any transition involving affected addresses must account for the possibility that assets connected with the incident may have moved through different wallets or transactions. By introducing an address verification system, auditing the migration tool and coordinating with exchanges before wider deployment, Zilliqa is taking a staged approach to the recovery process. The first exchange migrations planned for the end of August will provide an important test of the system under real operating conditions. Their progress could help determine how quickly additional platforms and users can participate in subsequent stages. Zilliqa's recovery strategy combines address verification, a security audit and phased exchange migrations as it works to restore confidence following the Ledger incident. The developments mark a significant step toward normalizing activity around Zilliqa EVM. However, the ongoing stolen-funds investigation means the recovery process is not yet complete. Further updates are expected as the migration audit progresses, exchange participation expands and investigators continue to assess the affected funds.

Zilliqa halts native transactions after Ledger app flaw exposes private keys. 17 hours ago Zilliqa has halted native ZIL transactions following the discovery of a critical vulnerability in the network's Ledger application, which allows the private keys of certain accounts to be recovered from public signatures on the blockchain. The incident was disclosed after an undisclosed amount of ZIL was stolen from an exchange partner's cold wallet, forcing the project to request centralized platforms to pause ZIL deposits and withdrawals to curb the movement of funds. According to Zilliqa, the flaw lies in the native transaction signing process using the Ledger app and does not affect EVM transactions or official SDKs. The project stated that the vulnerability had existed in app versions dating back to 2019, with on-chain exploitation signs detected on July 19, 2026, two days before the root cause was isolated. Exchange theft and initial response. Zilliqa publicly disclosed the incident on July 20, stating that an undisclosed amount of ZIL had been stolen from an exchange partner's cold wallet. At the time, the project did not specify the technical cause or the scale of damages, noting that an investigation was ongoing to determine the root cause and the scope of impact. CryptoFig has been made aware of a security incident involving one of its exchange partners, in which ZIL was stolen from a cold wallet. The incident is under active investigation, and CryptoFig is working with the relevant parties to establish the root cause and full scope. As a... - Zilliqa (@zilliqa) July 20, 2026 Exchanges were subsequently notified and requested to pause ZIL deposits and withdrawals as a precautionary measure to prevent the stolen funds from being transferred or sold through centralized platforms while the verification process continued. On July 21, Zilliqa updated that it found no evidence suggesting the incident originated from wallet management procedures or operational activities of the exchange. The investigation then shifted to a technical issue affecting transaction signing in a group of legacy ZIL1 wallets, before the project disclosed detailed information about the vulnerability in the Zilliqa Ledger app a day later. Affected wallets and transaction scope. Zilliqa limited the scope of impact to private keys that had been used to sign native Zilliqa transactions via a Ledger device. According to the project's advisory, accounts that have broadcast approximately 5 or more native transactions using the Zilliqa Ledger app should be considered compromised. This risk applies to signatures already publicly recorded on-chain, meaning subsequent software updates cannot reverse the exposure level of affected private keys. Users with accounts in this group must stop using the compromised keys, rather than merely updating the transaction-signing app. EVM transactions are unaffected, while transactions signed through official SDKs such as zilliqa-js, gozilliqa-sdk, and pyzil are also outside the scope of the flaw. The incident is therefore isolated to the native signing path of the Zilliqa Ledger app. Zilliqa has not disclosed the amount of ZIL stolen, the number of affected accounts, or the total value of assets held in vulnerable addresses. As a result, the overall financial extent of the incident remains unclear. Ledger app vulnerability. The root cause lies in how the Zilliqa Ledger app generates nonces for EC-Schnorr signatures on the secp256k1 curve. For each signature, the app needs to generate a fresh, random, and unpredictable 256-bit nonce; if the nonce is biased or lacks entropy, multiple signatures can expose the private key. The app's signing routine generates 40 bytes of randomness and then reduces this value modulo the order of the curve to produce a 256-bit number. However, when copying the result into the nonce buffer, the code mistakenly extracted 32 bytes from the 40-byte output, retaining 8 bytes of zero-padding while discarding 8 bytes of entropy. This flaw leaves the 64 most significant bits of each nonce fixed at zero. With approximately 5 or more affected signatures, the private key can be recovered in seconds on commodity hardware using Hidden Number Problem solving and lattice reduction techniques. Native transaction halt. Zilliqa halted native non-EVM transactions as a protective measure while finalizing a remediation plan. The move aims to prevent further asset losses from vulnerable accounts while restricting the movement of stolen ZIL through the native transaction flow. Affected accounts cannot be protected by a standard transfer transaction either. If a private key can already be recovered from on-chain data, an attacker holding the same key can detect and front-run the user's asset transfer transaction. Therefore, attempting to move funds independently may be ineffective and increase risk, while EVM transactions continue to remain unaffected. Remediation plan and user guidance. A fixed build of the Ledger app is being prepared in coordination with Ledger. This fix will restore the full nonce generation process to prevent the app from creating further weakened signatures in the future. However, the patch cannot reverse the risk for private keys that have already signed the required number of affected native transactions previously. Keys belonging to the affected group ultimately need to be retired from use. Zilliqa is finalizing a remediation plan to safeguard balances in associated accounts and will publish separate instructions for users who have signed native Zilliqa transactions using Ledger. Until official guidance is provided, users are advised not to act independently and to monitor only the project's official channels. KuCoin was credited by Zilliqa for assisting in identifying the root cause within the Ledger app's nonce generation process, recovering affected private keys from on-chain data, and confirming ongoing exploitation activity. However, Zilliqa has not publicly confirmed whether KuCoin was the exchange partner that lost ZIL in the initial announcement.