ZetaChain transactions paused after attack against team wallets

ZetaChain suffered a recent exploit, extending the streak of smart contract attacks in April. The smart contract attack mostly affected team wallets. 

ZetaChain shut down its cross chain services, with over 15 hours of no transactions to prevent further losses. The only possible transactions are internal transfers on ZetaChain. The team stated that no user wallets were affected, and the team has managed to cut the losses. 

On-chain research showed the main reason for the exploit was the smart contract that moved funds between ZetaChain and Ethereum. ZetaChain is a public L1 chain, compatible with the Cosmos ecosystem and the OmniChain project. The network allows apps to perform cross-chain transfers through a dedicated smart contract.

ZetaChain exploited by flawed bridge contract

The main reason for the exploit was identified as the GatewayZEVM contract, which lacked access control and validation. This allowed users to make cross-chain calls and order operations on external chains. 

The attacker was able to make a malicious call on the contract to trigger a cross-chain transaction without sufficient backing. The ZetaChain relayer took the transaction as valid and sent real funds on the destination chain, allowing the attacker to receive real funds. 

So far, the identified losses were limited to USDC for a relatively small sum held on an Ethereum address. The loss was limited early, but the funds are not frozen or tagged. The latest attack shows that Web3 vulnerability is still a major weakness for all Web3 projects. 

The attack against ZetaChain showed that all smart contracts are targeted, even those belonging to relatively small chains with limited value locked. After the October 2025 market crash, ZetaChain holds under $1M in its DeFi smart contracts. 

Are other chains exposed? 

The ZetaChain exploit reveals increased interest in all remaining Web3 chains, where contracts still allow for the extraction of value. 

The ZetaChain hack, which took under $10,000, could also be a form of testing for vulnerabilities in similar contracts. 

ZetaChain is part of the Cosmos ecosystem, which made a push toward permissionless cross-chain compatibility. The chain shows extremely low activity, with only a handful of daily users and just $8 in daily fees. Similar contracts on the Cosmos chain may be vulnerable to attacks. 

Following the exploit, the ZETA native token traded in its usual range at $0.054. The token has already lost over 96% of its value since the launch, and has been almost unaffected by the hacking news. The token itself was not the object of attack and was not traded or sold by the exploiters.

As Cryptopolitan reported, the recent Drift Protocol hack made all Web3 projects more vigilant.

Attacks accelerated in April, with two of the biggest hacks for the year happening within weeks of each other. For the past month, DeFi Llama data shows over $624M were lost to hacks and exploits, the highest level since February 2025.