On April 29, ZetaChain released a post-incident analysis report confirming that the attack on April 24 originated from a vulnerability in its cross-chain messaging pipeline. The attacker exploited three interconnected issues: the cross-chain system allowed for 'arbitrary calls' with minimal restrictions; the receiving GatewayEVM contract accepted most commands, including 'transferFrom'; and users had granted unlimited authorization when depositing tokens via 'GatewayEVM.deposit()' without revoking it, allowing the attacker to withdraw tokens from wallets. The attack involved nine transactions across four chains: Ethereum, Arbitrum, Base, and BSC, resulting in a total loss of $333,868 (mainly in USDC and USDT), affecting only three internal team wallets with no loss of user funds. ZetaChain stated that the attacker was not an opportunist but had invested significant time and resources in preparation, including funding the wallet through Tornado Cash three days before the attack and conducting brute-force attacks to mimic the victim's address. ZetaChain has since deployed a patch, and the cross-chain transaction feature will remain disabled until the upgrade and review are completed.