Zoth, an Ethereum-based real-world asset platform, has suffered an $8.85 million exploit after attackers gained unauthorized access to a private key.
The breach marks the second major security incident for Zoth in a month, highlighting ongoing vulnerabilities in DeFi protocols.
The attacker reportedly compromised the protocol’s deployer wallet, allowing them to upgrade the “USD0PPSubVaultUpgradeable” proxy contract to a contract under their control.
🚨ALERT🚨Our system has detected a suspicious transaction involving @zothdotio. It appears that the protocol's deployer wallet has been compromised.
30 minutes ago, the proxy contract "USD0PPSubVaultUpgradeable" was upgraded to a contract created by a suspicious address.
The… pic.twitter.com/3OHmvJYpR5— 🚨 Cyvers Alerts 🚨 (@CyversAlerts) March 21, 2025
This maneuver helped them to withdraw $8.4 million in Zoth’s USD0++ stablecoin, which was quickly swapped for 8.3 million DAI and moved to an external address.
In response, Zoth has placed its website in maintenance mode and is working with security partners to assess the damage and prevent further exploits.
Proxy contract hack
Proxy contracts, widely used in DeFi for upgradability, introduce a risk when private keys securing them are compromised. The unauthorized upgrade in Zoth’s case demonstrates how attackers can manipulate contract logic to reroute funds without resistance.
This breach follows a March 6 exploit in which Zoth lost $285,000 due to a liquidity pool vulnerability. Repeated security failures raise concerns about the platform’s risk management and could invite regulatory scrutiny.
