Zoth hack — March 2025

On 21 March 2025 an attacker emptied a vault belonging to Zoth, a real-world-asset restaking protocol on Ethereum, of USD0++ that backed its ZeUSD product.

The private key controlling Zoth's deployer address had been compromised, and that address held admin rights over the protocol's proxy contracts. Cyvers, which flagged the transaction, said a Zoth contract "was upgraded to a malicious version deployed by a suspicious address" about thirty minutes before the withdrawal. Once the implementation had been swapped the attacker could move the vault's balance directly. The proceeds were converted to DAI, sent to another address and then swapped into ether, 4,223 ETH by one on-chain count. How the key was obtained has not been established publicly.

Published figures differ. Cyvers put the loss at about $8.4 million and that number was the most widely repeated, with Halborn's write-up giving the same figure; other on-chain analyses reported $8.85 million of USD0++ leaving the contract. Zoth said on X that its "system has experienced a security breach", that it was working with partners, and promised a detailed report.

This was the second incident at Zoth that month. On 6 March a separate flaw allowed synthetic assets to be minted without sufficient collateral, costing about $285,000. In May 2025 Zoth announced a compensation programme for affected users and a phased relaunch of ZeUSD. No funds have been reported recovered and no one has been identified.