PANews reported on April 28th that, according to SlowMist's analysis, the root cause of the ZetaChain attack lies in the lack of access control and input validation in the GatewayZEVM contract's `call` function. This allows any user to initiate cross-chain calls through GatewayZEVM and execute arbitrary operations on external chains via relays. Attackers exploited this vulnerability to construct malicious cross-chain events on ZetaChain. After the relays captured these events, they executed malicious calls on the target chain via TSS, thereby stealing funds.

Previously, ZetaChain reported that its GatewayEVM contract had been attacked, but the attack route has been blocked and user funds are safe .