ZetaChain Vulnerability Previously Reported by White Hat but Ignored, Resulting in $334,000 Attack Event

On April 29, cross-chain protocol ZetaChain revealed details of a $334,000 exploit—after previously dismissing a bug bounty researcher’s report of the underlying issues as “intended behavior.” Per its official post-incident report, the attack exploited three seemingly independent, low-risk design flaws: - The Gateway contract allowed anyone to send arbitrary cross-chain instructions - Receivers could call nearly any contract, with overly narrow blacklist restrictions - Some wallets had long-unrevoked unlimited approvals The attacker leveraged these gaps to direct the Gateway to transfer tokens directly to their controlled address. The exploit spanned 9 transactions across Ethereum, Arbitrum, Avalanche, and BSC; stolen funds came from ZetaChain-controlled wallets, and user assets were unaffected. The official statement emphasized the attack was premeditated: the attacker deposited funds via Tornado Cash three days prior, pre-deployed a dedicated Drainer contract, and executed an address poisoning attack. ZetaChain is now rolling out a fix patch to mainnet nodes, permanently disabling arbitrary call functionality and replacing the deposit process’s unlimited approval system with “specific amount approval.”