ZetaChain Exploit Drains $334,000 from Team Wallets

ZetaChain, a cross-chain blockchain platform, confirmed an exploit on April 26 that drained about $334,000 from three internal team-controlled wallets across Ethereum, Arbitrum, Base, and Binance Smart Chain. No user funds were affected, and the platform quickly paused cross-chain transactions to limit damage before deploying patches.

The attack targeted the GatewayEVM contract, which handles cross-chain messaging. ZetaChain detailed in its postmortem that the exploit combined three design flaws. The gateway permitted arbitrary cross-chain instructions from any sender without restrictions. On the receiving end, it executed a wide range of commands on target contracts, protected only by a narrow blocklist that overlooked key ERC20 functions like transferFrom. Victim wallets had previously granted unlimited token approvals to the gateway, which remained active and allowed the attacker to move funds via nine drain transactions.

ZetaChain stated the assault was premeditated. The attacker funded its wallet through Tornado Cash three days prior, deployed a custom drainer contract on ZetaChain, and used address poisoning. This involved a vanity address mimicking a victim's with 13...