ZetaChain — Triple-Bug GatewayEVM Cross-Chain Exploit

Timeline: ~April 24: Attacker funds wallet via Tornado Cash. April 26, 12:51 UTC: Exploit begins via three combined defects: (1) GatewayZEVM.call() had no access control, (2) GatewayEVM.execute() accepted arbitrary calls including transferFrom, (3) old unlimited ERC-20 approvals never revoked. Attacker deploys exploit contract on ZetaChain, calls unauthenticated GatewayZEVM.call() to emit spoofed Called events; ZetaChain TSS validators sign off; GatewayEVM.execute() executes transferFrom against pre-approved team wallet allowances on 4 destination chains over 9 cross-chain calls. 23:00 UTC: Drain window ends. April 27, ~14:08 UTC: Attacker consolidates 139 ETH. April 27: ZetaChain publicly discloses; pauses cross-chain on mainnet. April 29: Full post-mortem published. Cross-chain transactions later resumed; attack vector blocked.