Cross-chain interoperability protocol Zetachain has temporarily suspended mainnet operations following a security breach that exploited a vulnerability in its GatewayZEVM smart contract. The attack, which occurred on April 28, 2026, drained approximately $300,000 from the protocol’s internal team wallets. The team confirmed that user funds were not directly impacted.
Incident Timeline and Initial Response
Zetachain detected suspicious cross-chain transactions and promptly halted all cross-chain activity to contain the breach. The protocol engaged Slowmist, a leading blockchain security firm, to conduct an investigation. Within hours, Slowmist identified the root cause: the call function in the GatewayZEVM contract lacked both access control and input validation mechanisms.
This design flaw allowed any external address to trigger unauthenticated cross-chain calls and route arbitrary payloads to unintended destination chains. Independent security outlet Wu Blockchain later corroborated the findings. Zetachain stated that its security team is currently assessing the full scope of the incident, and a formal post-mortem will be released upon completion.
Slowmist Analysis: Missing Access Control and Input Validation
According to Slowmist's preliminary report, the call function in GatewayZEVM exposed a critical vulnerability. The function had no access control—meaning any external account could invoke it without permission—and no input validation, enabling attackers to craft malicious payloads and direct them across chains, bypassing any assumed trust boundaries within the contract logic.
Security researchers have consistently flagged insufficient access controls as one of the most common and preventable vulnerabilities in production smart contracts. It remains unclear whether Zetachain's GatewayZEVM contract had undergone a formal third-party security audit prior to deployment.
Industry Context: Second Major Cross-Chain Exploit in April 2026
The Zetachain incident marks the second major cross-chain exploit in April 2026. Earlier this month, the KelpDAO hack triggered a cascade of liquidity withdrawals across decentralized finance (DeFi) protocols, causing the worst liquidity crunch since 2024. In response, the Arbitrum Security Council took emergency action to freeze 30,766 ETH linked to the KelpDAO exploiter.
Cross-chain bridges and messaging protocols have long been a focal point for security concerns. The Zetachain event underscores the ongoing risks: even with the best intentions, missing permission checks on sensitive contract functions can lead to significant financial losses. The broader DeFi ecosystem continues to grapple with the balance between interoperability and security, as each new exploit serves as a reminder that rigorous auditing and proactive security measures are essential.