Real-world asset (RWA) restaking protocol Zoth has fallen victim to a significant security breach, resulting in the theft of over $8.4 million in cryptocurrency. The incident has raised alarms within the decentralized finance (DeFi) community, prompting Zoth to take its website offline for maintenance as it investigates the breach.
Key Takeaways
-
Zoth lost $8.4 million due to a hack involving a compromised contract.
-
The attacker quickly converted stolen assets into DAI stablecoin.
-
The breach highlights vulnerabilities in smart contract protocols and the need for improved security measures.
Overview Of The Incident
On March 21, blockchain security firm Cyvers alerted the community to a suspicious transaction linked to Zoth's deployer wallet. The attacker exploited a vulnerability that allowed them to withdraw a staggering $8.4 million in crypto assets. Within minutes, the stolen funds were converted into DAI and transferred to a different address, indicating a well-planned operation.
Details Of The Hack
According to reports, the hack was facilitated by a leak in admin privileges. Approximately 30 minutes before the attack was detected, a proxy contract named "USD0PPSubVaultUpgradeable" was upgraded to a malicious version linked to an address associated with the suspected attacker. This upgrade bypassed existing security mechanisms, granting the attacker full control over user funds almost instantly.
Response From Zoth
In response to the breach, Zoth has taken its website offline and is currently in maintenance mode. The team has acknowledged the security breach and is working closely with partners to mitigate the impact and resolve the issue. They have promised to release a detailed report once their investigation is complete.
Implications For The DeFi Space
The incident underscores the ongoing risks associated with decentralized finance protocols. Hakan Unal, a senior SOC lead at Cyvers, emphasized that admin key compromises remain a significant threat in the DeFi ecosystem. He suggested that implementing multisig contract upgrades, adding timelocks on upgrades, and enhancing key management practices could help prevent similar attacks in the future.
Background On Zoth
Founded in January 2023 by Pritam Dutta and Koushik Bhargav, Zoth raised $4 million in August 2024 to launch its tokenized liquid note, which is backed by secure assets such as U.S. Treasury Bills and top-rated corporate bonds. The funding round attracted support from various investors, including Taisu Ventures and G20, as well as prominent angels from Coinbase and Hedera.
As the Zoth team works to address the fallout from this incident, the DeFi community remains on high alert, reflecting the ongoing challenges of securing decentralized protocols against sophisticated attacks.
Sources
-
Hacker steals $8.4M from RWA restaking protocol Zoth — TradingView News, TradingView.
-
Restaking protocol Zoth exploited, attacker drains $8.4m, Crypto News.
This article was created with support from AI-driven technology, drawing on multiple reputable sources. The final content has been thoroughly reviewed and edited by BlockzHub's editorial team to ensure accuracy, clarity, and coherence. Original reporting sources are credited whenever appropriate and as required. The opinions expressed in this article do not necessarily represent the official views or positions of BlockzHub. This article is intended for informational purposes only and should not be considered financial or professional advice. Investing involves risk, and you should consult a qualified financial advisor before making any investment decisions.