ZetaChain Releases Incident Analysis: Cross-Chain Message Passing Vulnerability Leads to $330,000 Loss

On April 29, ZetaChain released a post-mortem report confirming the April 24 attack stemmed from a vulnerability in its cross-chain messaging channel. The attacker exploited three interconnected issues: - The cross-chain system allowed unrestricted arbitrary function calls; - The GatewayEVM contract on the receiving side accepted most commands—including "transferFrom"; - Users had previously granted irrevocable, unrestricted approvals when depositing tokens via the GatewayEVM.deposit() function, enabling the attacker to withdraw tokens from their wallets. The attack involved 9 total transactions across Ethereum, Arbitrum, Base, and BSC chains, resulting in $333,868 in total losses (primarily in USDC and USDT). It only impacted three internal team wallets—no user funds were lost. ZetaChain noted the attacker was not an opportunist; they had invested significant time and resources in preparation, including funding wallets via Tornado Cash three days prior to the attack and conducting a brute-force attack to spoof victim addresses. ZetaChain has since deployed a patch; cross-chain transaction functionality will remain disabled until upgrades and reviews are finalized.