Incident Overview
On December 12, 2025, ZEROBASE's frontend was compromised by hackers who deployed a phishing contract on BNB Chain that impersonated the official ZEROBASE interface to trick users into granting USDT approvals, resulting in theft of over $240,000 from 270+ users.
The attack involved a frontend compromise where hackers changed ZEROBASE's user interface to redirect users to a malicious contract on BSC that falsely presented itself as the official ZEROBASE staking platform. When users attempted to interact with what they believed was the legitimate ZEROBASE interface, they were prompted to approve the phishing contract for USDT transfers, granting the attackers permission to drain their wallets. The exploit affected over 270 users, with losses ranging from small amounts to a single victim losing 123,597 USDT.
In response, ZEROBASE implemented an automated detection system that identifies wallets with malicious approvals and prevents further interaction with the platform until users revoke the dangerous permissions through tools like DeFi Shield.
Malicious Contract: https://bscscan.com/address/0x0dd28fd7…152396
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Zerobase, these are the critical security checks that could have prevented this incident (December 2025).
- Verify all logic paths related to Phishing are guarded by proper access controls and input validation - see the Phishing Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next Zerobase
The Zerobase hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.