Zilliqa asks exchanges to pause ZIL transfers after suspected cold-wallet theft
Zilliqa has urged cryptocurrency exchanges to temporarily suspend ZIL deposits and withdrawals after a partner exchange reported a suspected cold-wallet compromise that resulted in stolen tokens. The project said it is investigating the incident with the unnamed partner but has not disclosed how many ZIL were taken, their value, or the method the attacker used.
What Zilliqa said and what’s happening
- Zilliqa confirmed that ZIL was stolen from a cold wallet controlled by an exchange partner and that the incident is under active investigation. The team asked the community to rely on its official channels while investigators verify details.
- The announcement frames the event as a partner exchange compromise rather than a breach of the Zilliqa blockchain itself, and no technical postmortem or affected company name has been released.
- As a precaution, Zilliqa contacted exchanges and requested temporary restrictions on ZIL transfers. These restrictions limit deposits and withdrawals on participating trading platforms while checks continue; on-chain transfers between Zilliqa addresses are not affected.
Exchange reaction
- Bitget separately announced it would suspend ZIL deposits and withdrawals on the Zilliqa network from July 20 at 18:15 UTC+8 for “wallet maintenance,” with reopening time to be announced later. Bitget’s notice did not explicitly link the maintenance to the reported theft.
Market impact
- The theft news weighed on market sentiment: CoinGecko showed ZIL trading near $0.00254 at the time of reporting, down roughly 9% over 24 hours. Prices remain volatile while details are scarce.
Cold wallets aren’t infallible
- Cold wallets keep private keys offline and are widely used by exchanges for large holdings, but offline storage does not eliminate all risks. Attackers can target signing devices, obtain private keys, or exploit internal operational controls to move funds.
- High-profile precedents underscore this risk: in February 2025, Bybit lost about $1.4 billion after attackers compromised a cold-wallet transaction process. In May, a roughly $520,000 loss tied to Polymarket activity was linked to a compromised private key used for an internal operations wallet.
What remains unknown
Zilliqa has not clarified whether the theft involved a stolen private key, a compromised signing system, or another failure. It also has not said whether the stolen ZIL have been moved to other addresses or deposited on centralized exchanges. Until investigators publish wallet addresses, transaction records, or a technical review, the amount stolen and the movement of funds cannot be independently verified.
Background on Zilliqa
- Zilliqa launched its mainnet in 2019 and is known for using sharding to scale transaction processing. ZIL is the network’s native token for fees and smart contract activity.
- The project has faced network issues in the past (including a bug that interrupted block production and a permanent fix announced in September 2024), but those operational incidents have not been linked to this exchange partner theft.
What to watch next
- Key open questions include the identity of the affected exchange, the size and value of the loss, the attack method, and when exchanges will restore normal deposit/withdrawal operations. Zilliqa has not provided a timeline for completing its investigation.
For now, users should monitor Zilliqa’s official channels and exchange notices for verified updates before attempting ZIL transfers.
Read more AI-generated news on: undefined/news
