ZetaChain Announces Incident Analysis: Cross-Chain Message Passing Vulnerability Causes $330k Loss

BlockBeats News, April 29 — ZetaChain recently released a post-incident analysis report confirming that the attack on April 24 originated from a vulnerability in its cross-chain messaging pipeline. The attacker exploited three interconnected issues: the cross-chain system allowing "arbitrary calls" with minimal restrictions; the receiving GatewayEVM contract accepting most commands, including "transferFrom"; and previously, users granting unlimited, non-revocable permissions when depositing tokens via "GatewayEVM.deposit()", enabling the attacker to extract tokens from wallets.

This attack involved a total of 9 transactions across four chains: Ethereum, Arbitrum, Base, and BSC, with total losses of $333,868 (mainly USDC and USDT), affecting only three internal team wallets, with no user funds lost. ZetaChain stated that the attacker was not opportunistic but had invested significant time and resources in preparation, including funding the wallet through Tornado Cash three days before the attack and launching brute-force attacks to mimic the victim addresses. Currently, ZetaChain has deployed patches, and cross-chain transaction functions will remain disabled until the upgrade and review are complete.