Zilliqa hires investigators after X-Bridge complaints; about $845,000 left on one signature

Zilliqa said at 8:19 a.m. ET on Oct. 25 that it had engaged "a leading firm from the crypto space, specialised in cybersecurity and AI-driven attacks," to help investigate "the situation," and that it was taking the matter "extremely seriously" [1]. The post does not name a bridge, a loss figure, or the firm. It followed days of user posts about Zilliqa's X-Bridge. Le Coin is not tying that statement to the Oct. 8 withdrawals in Zilliqa's voice until Zilliqa confirms the link and names the firm.

What left the bridge on Oct. 8

Ethereum block 26,144,997, mined at 03:29:23 UTC on Oct. 8 (11:29 p.m. ET Oct. 7), contains four successful calls from 0x29cd9c758239259a15792591a9aa64667a409572 to 0x49ea20823c953dd00619e2090dfa3965c89269c3 [2]. Receipts show 343,801.12 USDT, 79,371.00 USDC, 5.16344432 WBTC, and an XCAD balance left 0x2ee8…ede5 for 0x7285…6d82 [2].

Zilliqa's X-Bridge config lists 0x49EA…69C3 as the Ethereum chainGatewayAddress and 0x2EE8…De5 as the LockAndRelease tokenManagerAddress for USDT, WBTC, XCAD and other listed assets; a mainnet deploy broadcast puts the ValidatorManager proxy at 0x9f71…2915 beside that gateway [3]. Competing wallet Bearby labels the same contracts TokenManager and MessageBus; Le Coin uses Zilliqa's names [3][5].

At that block, the validator manager's getValidators() call returned exactly one address: 0x29cd…9572, the same address that sent the four transactions [2]. A later read returned a different single address, 0x092a…a3a8 [2]. The stablecoins sum to about $423,000. At CoinMarketCap's Oct. 8 bitcoin price of $81,676, the WBTC is about $422,000, for about $845,000 before XCAD [2][4]. Bearby puts the total near $1.0 million; that figure is Bearby's [5].

How a one-of-one validator set works

X-Bridge, in Zilliqa's UCCB design, dispatches cross-chain messages only after a supermajority of the bridge validator set has signed [3]. The live set is whatever addresses getValidators() returns on the validator manager. With N validators, a common two-thirds rule needs ceil(2N/3) signatures. When N is 1, that threshold is 1: one signature meets the bar. Anyone can call getValidators() on the manager contract and count the returned addresses. That is a description of the mechanism on the chain Le Coin read, not advice about using the bridge.

Prior X-Bridge record, briefly

Zilliqa's Feb. 20, 2025 blog describes a Feb. 6, 2025 X-Bridge incident that minted bridged ETH and BNB without locking matching source-chain assets [6]. That is prior context, not a finding about the Oct. 8 key.

Bearby, a competing wallet, has alleged in posts since Oct. 24 that the Oct. 8 outflow was not a conventional external hack [5]. Le Coin is not adopting that framing. The chain shows four withdrawals in one block, authorized under a one-address validator set, after which that address was replaced [2].

The objection

A fair objection is that Zilliqa's Oct. 25 post never says "X-Bridge" or "$845,000," so linking it to these withdrawals is Le Coin's sequencing of a statement after complaints, plus an independent chain read [1][2]. A later getValidators() change also does not identify who held the prior key. Both limits stand.

The tell

In Le Coin's view, the tell is whether Zilliqa names the firm, states whether the engagement covers the Oct. 8 X-Bridge withdrawals, and publishes what the current validator set and threshold are after the swap [1][2][3]. Until those points are on the record from Zilliqa, the checkable facts remain the four transactions, the one-of-one validator read at that block, and the unsigned scope of today's statement.

Sources

1. Zilliqa (@zilliqa), post on X, Oct. 25, 2026, 8:19 a.m. ET, https://x.com/zilliqa/status/2114330935495967099; exact quote on engaging a leading crypto firm "specialised in cybersecurity and AI-driven attacks" to investigate "the situation"; accessed Oct. 25, 2026, ~9:19 a.m. ET.
2. Ethereum block 26,144,997, timestamp 2026-10-08T03:29:23Z; four txs 0xeeba4507…, 0x875cfc71…, 0x3e56b446…, 0xe80b3ffc… from 0x29cd9c758239259a15792591a9aa64667a409572 to 0x49ea20823c953dd00619e2090dfa3965c89269c3; ERC-20 Transfer logs from 0x2ee8e8d7c113bb7c180f4755f06ed50be53bede5 to 0x72852ca943cdc2670b05238783ffbcaa0ae26d82 for 343,801.121784 USDT, 79,370.996209 USDC, 5.16344432 WBTC, and XCAD. Validator manager 0x9f71303ee8e1aa74dee0bc70a009420953e82915: getValidators() at that block returned [0x29cd…9572]; later read returned [0x092a…a3a8]. Le Coin eth.drpc.org read ~9:10 a.m. ET Oct. 25. https://etherscan.io/block/26144997
3. Zilliqa/xbridge, production bridge-web/src/config/config.ts (ethereum chainGatewayAddress 0x49EA20823c953dd00619E2090DFa3965C89269C3; LockAndRelease tokenManagerAddress 0x2EE8e8D7C113Bb7c180f4755f06ed50bE53BEDe5 for USDT/WBTC/XCAD and others); smart-contracts broadcast 02_deployCoreUpgradeable.s.sol/1/run-latest.json (ValidatorManager ERC1967Proxy 0x9f71303ee8e1aa74dee0bc70a009420953e82915; ChainGateway ERC1967Proxy 0x49ea…69c3). README: remote calls dispatch only with supermajority validator signatures; validator set via getValidators(). https://github.com/Zilliqa/xbridge ; accessed Oct. 25, 2026, ~9:19 a.m. ET.
4. CoinMarketCap BTC price Oct. 8, 2026, $81,676 (DAE shortlist 2026-10-25-0900); WBTC 5.16344432 × $81,676 ≈ $422K; stables ≈ $423K; combined ≈ $845K before XCAD. https://coinmarketcap.com
5. Bearby (@BearbyPro), posts on X, Oct. 24, 2026, including https://x.com/BearbyPro/status/2114095069623927263 and https://x.com/BearbyPro/status/2114055762892738848; competing-wallet ~$1.0M / ~$800K framing and TokenManager/MessageBus labels attributed to Bearby only; accessed ~9:10 a.m. ET Oct. 25.
6. Zilliqa, "Overview and Mitigation of X-Bridge Exploit," Feb. 20, 2025, https://blog.zilliqa.com/overview-and-mitigation-of-x-bridge-exploit/ ; accessed Oct. 25, 2026, ~9:19 a.m. ET.

Holding the Corner.

Not financial advice.