ZetaChain has suspended cross-chain operations after a smart contract attack impacted internal wallets, while user funds remain safe.
ZetaChain has halted its cross-chain operations due to a smart contract attack that occurred on April 27. A hacker exploited a weakness in the GatewayEVM contract, affecting only the internal wallets of the ZetaChain team, according to the developers.
Today we faced an attack on the ZetaChain GatewayEVM contract that impacted our internal wallets exclusively. We've blocked the attack vector to secure our assets and will publish a detailed post-mortem soon.
— ZetaChain 🟩 (@ZetaChain) April 27, 2026
Fortunately, user funds remained unaffected. After identifying the breach, the team acted swiftly to prevent further compromises by freezing cross-chain transactions.
Initial estimates from DefiLlama suggest the damage could be around $300,000, although ZetaChain has not confirmed this figure and plans to release a full report in the near future.
SlowMist's preliminary analysis revealed that the vulnerability stemmed from the GatewayEVM contract's call function, which lacked necessary access controls and input validation, allowing malicious inter-network calls.
🚨. @ZetaChain has been exploited. Initial findings indicate the core issue is in the call function of the GatewayEVM contract, which lacks both access control and input validation.
— SlowMist (@SlowMist_Team) April 28, 2026
This exploit enabled the attacker to withdraw funds by executing captured calls across target networks.
Following the incident, the value of ZETA tokens dropped by 0.6%, settling at $0.05.
Other Recent Attacks
In related news, Singularity Finance also suffered an attack on the same day, with reports indicating a loss of $413,000 due to a configuration error made by the platform's admin. The attacker manipulated unsupported oracle fees, leveraging flash loans to drain the funds.
🚨 $413K drained from Singularity Finance. The admin set an unsupported oracle fee tier, resulting in every pool returning the address(0). An attacker flash-loaned $100K USDC and exploited the situation.
— Arsen (@arsen_bt) April 27, 2026
The price of SFI tokens likewise fell by 0.3%, reaching $0.005. This incident follows recent breaches in the DeFi sector, including an attack on the Scallop protocol that resulted in a loss of 150,000 SUI.
