What happened
On April 27, 2026, ZetaChain announced an attack on its GatewayEVM contract and paused cross-chain transactions. ZetaChain said only internal team wallets were affected, while The Block reported that the team had not disclosed a loss amount at that time.
SolidityScan attributed the exploit to missing access control in GatewayZEVM.call combined with an unrestricted arbitrary-call path in GatewayEVM.execute.
How it happened
SolidityScan reported that attacker-controlled source-event payloads caused ZetaChain validators to sign destination-chain calls, including ERC-20 transferFrom calls against wallets that had approved GatewayEVM.
Protocol details
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
