A security incident at one of Zilliqa’s exchange partners has forced the network to ask all centralized platforms to halt ZIL deposits and withdrawals, freezing liquidity for the native token of one of the industry’s earliest sharding blockchains. The breach, first reported by WuBlockchain in the original report, targeted a cold wallet, raising immediate questions about how an offline storage system could be compromised.
The Zilliqa team confirmed that the stolen funds were ZIL tokens held in a partner exchange’s cold wallet, but neither the name of the exchange nor the precise amount taken has been disclosed. In a public statement, the project said it is working with the affected party and other stakeholders to determine the root cause and full scope of the loss. The decision to temporarily pause all centralized exchange deposits and withdrawals is a containment measure, aimed at preventing the attacker from moving or selling the stolen assets through regulated order books.
A Confirmed Breach, Few Details
The absence of key details means traders and liquidity providers are operating in the dark. Cold wallet thefts are rare because they typically require physical access, insider compromise, or a sophisticated attack on the custody infrastructure that eventually connects the wallet to hot systems for processing withdrawals. Zilliqa did not say whether the cold wallet belonged to a large-tier exchange or a smaller regional partner, leaving wide uncertainty over the potential market impact.
The chain, launched in 2017, has faced its share of technical and adoption hurdles despite being an early adopter of sharding. Projects that have been around for nearly a decade often rely on a handful of exchanges for liquidity, so a breach at even one partner can ripple through the market. ZIL is listed on several major exchanges, and the deposit freezes mean that arbitrageurs and market makers cannot rebalance positions, which could widen spreads or lead to brief dislocations once trading resumes.
Cold Wallets Are Not Always Cold
Cold wallets are supposed to be impervious to internet-based attacks because their private keys are stored offline. But recent history shows that even offline environments are vulnerable. In 2024, WazirX lost over $230 million after a multi-signature cold wallet was drained in what investigators believe was a combination of social engineering and compromised offline signers. While no connection to that event exists here, the pattern of cold wallet breaches is unsettling a market that has spent years being told that offline storage equals safety.
What makes this case particularly opaque is that Zilliqa’s disclosure labels the victim as an “exchange partner,” which likely means a third-party custodian or liquidity provider using Zilliqa’s infrastructure. The lack of transparency is not necessarily suspicious—forensic investigations often require silence—but it adds to the anxiety. If the exploit was due to a vulnerability in Zilliqa’s own transaction signing or multisig logic, it would be a systemic risk. If it was a purely operational failure at the exchange level, the damage might be more contained.
As institutions globally push for clearer custody rules—a debate captured by legislation like the GENIUS Act in the U.S., where banks are trying to kill the biggest crypto bill—incidents like this provide ammunition for those demanding that exchanges be held to bank-grade security standards. The incident also comes at a time when some altcoin foundations are aggressively marketing their chains to institutional staking services. Notably, Sui’s recent price surge was driven partly by institutional staking demand, as detailed in BlockchainReporter’s coverage. Cold storage failures erode the trust that such institutional interest is built on.
Market Freeze and Ecosystem Reaction
ZIL’s on-chain activity remains unaffected; the blockchain itself processes transactions as normal. The freeze only applies to centralized exchange interfaces, which still account for the bulk of retail volume. Decentralized exchanges like ZilSwap continue to operate, although liquidity is limited compared to major CEX venues. The incident is unlikely to cause a protocol-level downgrade, but it will test how the Zilliqa community and its remaining validators handle the reputational hit.
Meanwhile, developer activity on Zilliqa has been subdued relative to competing chains. According to recent data, networks like Ethereum, Solana, and BNB Chain dominate by developer activity, as shown in BlockchainReporter’s weekly ranking. For a chain that once positioned itself as a high-throughput alternative, the combination of a security shock and a shrinking developer footprint leaves it in a precarious spot.
What Comes Next
Zilliqa’s investigation will likely focus on whether the cold wallet’s signing process was subverted, whether a multisig threshold was bypassed, or whether physical media holding keys were accessed without authorization. Until that report surfaces, exchanges will keep deposit channels closed, effectively quarantining the ZIL that sits in their hot and cold wallets. That quarantine may last days or weeks, depending on the complexity of the forensic work and the legal implications if the exchange partner is subject to regulatory oversight in multiple jurisdictions.
For traders, the main risk is not necessarily a large-scale dump of stolen ZIL—centralized platforms are now gate-locked—but rather the overhang of uncertainty. When an investigation reveals systemic flaws, the affected asset can trade at a discount to broader market moves. For now, ZIL holders are waiting for clarity on a theft that should not have happened in the first place: a cold wallet breach, from a partner whose name they do not yet know.
