TLDR
- ZetaChain traced the exploit to its cross-chain messaging pipeline.
- The attacker drained $333,868 from three internal team wallets.
- No user funds were lost, according to ZetaChain’s post-mortem.
- The exploit involved GatewayEVM and old token approvals.
- ZetaChain patched the flaw and kept cross-chain transfers paused.
ZetaChain said a cross-chain messaging loophole enabled a targeted April 24 exploit that drained $333,868 from internal team wallets. The team said no user funds were lost, but the attacker used GatewayEVM permissions, old token approvals, and careful preparation to carry out the attack across four major blockchains.
ZetaChain identifies messaging flaw behind exploit
ZetaChain said its April 24 exploit came from a loophole in its cross-chain messaging system. The Layer 1 network said the attack targeted GatewayEVM, its entry point for cross-chain actions.
The team said no user funds were lost during the incident. However, three internal team wallets lost $333,868 across nine transactions.
The stolen assets were mainly USDC and USDT. The transactions took place on Ethereum, Arbitrum, Base, and BSC.
GatewayEVM approvals enabled token drain
ZetaChain said the attacker used three issues at the same time. Its cross-chain system allowed broad requests for arbitrary calls with limited checks.
The GatewayEVM contract also accepted many commands on the receiving side. These included transferFrom, which can move approved tokens.
Some users had earlier used GatewayEVM.deposit and granted unlimited token approvals. Those approvals were not revoked, and the attacker used them to drain assets.
ZetaChain said, “This was not an opportunistic attack.” The team added that the attacker spent time and resources before carrying it out.
Team patches flaw and keeps transfers paused
The attacker funded a wallet through Tornado Cash around three days before the exploit. ZetaChain said this was likely done to hide the source of funds.
The team also reported a brute-force attack on a vanity address. It said the move appeared similar to address poisoning, which can hide malicious activity.
After the exploit, the attacker swapped the stolen USDC and USDT for ETH. ZetaChain later deployed a mainnet patch to remove the vulnerability.
Cross-chain transaction functions remain paused for now. ZetaChain said they will reopen after upgrades and further reviews are complete.
The team advised users to revoke any active ERC-20 allowances given to listed gateway addresses. It said this step is a precaution for past GatewayEVM users.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
