Altcoins

Another Day, Another Crypto Breach: RWA Protocol ZOTH Loses $8.85 Million

Mar 21, 2025

A protocol for real-world assets (RWA) operating on ETH has experienced a cyberattack that has led to a financial rekt of $8.85 million. Zoth, which brands itself as a ‘RWAFi’ platform, was previously compromised earlier this month.

Experts in protection suggest that this most recent breach occurred due to a compromised deployer wallet, following a six-figure wrecked earlier in March suffered by Zoth.

ALERTWe have identified a suspicious transaction related to @zothdotio. It seems that the deployer wallet of the protocol has been compromised.

Thirty minutes ago, the proxy contract “USD0PPSubVaultUpgradeable” was modified to a contract established by a suspicious source.
The… pic.twitter.com/3OHmvJYpR5

— Cyvers Alerts (@CyversAlerts) March 21, 2025

Cyvers, The Real-Time Safety Alert Platform, First Detected The Vulnerability breach

Earlier today (March 21, 2025), a proxy contract within the Zoth framework was modified by what the security company Cyvers identified as a “suspicious address.”

Less than thirty minutes later, $8.85 million worth of the USD0++ stablecoin (the staked version of the USD0 crypto token) was extracted from the proxy contract to the hackers’ wallet.

Subsequently, all of the USD0++ was rapidly converted into DAI stablecoin before being sent to a different address. Another web3 security firm, PeckShield, observed that the assailant had swapped the DAI for 4,223 ETH, valued at $8,300,800 based on current market rates.

Cyvers concluded its alert by mentioning that the Zoth website is currently down and undergoing maintenance, likely in reaction to the incident.

#PeckShieldAlert @zothdotio hacker has exchanged the siphoned funds for 4,223 $ETH pic.twitter.com/OAlYk1TqJg

— PeckShieldAlert (@PeckShieldAlert) March 21, 2025

DISCOVER: 20+ Next Crypto to Explode in 2025

Zoth Issues Statement Regarding The Exploit, Promises “Further updates will be provided soon”

The Zoth account on X has briefly commented on the situation with an official statement.

“Our system has encountered a protection breach. We are currently investigating the situation and taking all necessary steps to resolve it as quickly as we can,” the statement remarked.

The organization also mentioned that they are collaborating with their partners to minimize the repercussions and resolve the issue entirely. “A comprehensive report providing clarity will be shared once the investigation is wrapped up.”

In the meantime, Zoth has yet to clarify how the private key of the contract was accessed by the intruder. However, they reassured their community that a thorough announcement will be issued once a complete investigation is concluded.

This has been a challenging month for Zoth since this marks the second hacking incident affecting the RWA/DeFi protocol within a single month. On March 6, Zoth faced a $285,000 wrecked when attackers took advantage of a Uniswap V3 liquidity pool.

This marks the second hacking incident this month for RWAFi platform Zoth, following a rekt of $285,000 to a Uniswap V3 market fluidity pool on March 6