Hacker steals $8.4M from RWA restaking protocol Zoth

Key Points

  • Zoth, a real-world asset (RWA) re-staking protocol, lost over $8.4 million due to a security breach involving compromised admin privileges.
  • The stolen assets were quickly converted into DAI and then into Ether (ETH), with the platform's website going into maintenance mode post-incident.
  • The hack was likely due to a malicious contract upgrade, highlighting the need for better security measures like multisig upgrades and real-time alerts.

Summary

On March 21, 2025, Zoth, a protocol specializing in real-world asset re-staking, fell victim to a significant security breach, resulting in the loss of over $8.4 million in cryptocurrency. The exploit was facilitated by compromised admin privileges, allowing the attacker to withdraw funds and convert them into DAI before moving them to another address. Blockchain security firm Cyvers identified the breach, noting that the protocol's deployer wallet was compromised. In response, Zoth's website was put into maintenance mode, and the team promised a detailed incident report post-investigation. The attackers further swapped the assets into Ether (ETH). The incident underscores the vulnerabilities in smart contract protocols, particularly the risks associated with centralized control over upgrades and the need for enhanced security measures like multisig contract upgrades and real-time alerts for admin role changes. Despite these preventive measures, the security expert from Cyvers, Hakan Unal, believes that such attacks will persist as long as there are centralized points of failure in DeFi systems.

cointelegraph
March 23, 2025
Crypto
Read article

Related news