Zoth协议休息合同被黑客入侵，耗资840万美元的用户耗尽了

Zoth协议是一项重点是现实世界资产（RWA）风险的重新制定协议，并在3月21日进行了一次重大利用。违规行为损失了840万美元。

Yerevan (Coin Chapter) – Zoth protocol, a restaking protocol with exposure to real-world assets, experienced a major exploit on March 21. The breach resulted in a loss of $8.4 million, leading the platform to take its website offline and move to maintenance mode.

埃里万（Coin Chapter） - Zoth协议是一项重新制定的协议，并在3月21日经历了重大利用。违规行为损失了840万美元，导致该平台使其网站离线并转移到维护模式。

The suspicious activity was flagged by blockchain security firm Cyvers, which traced the issue to the Zoth deployer wallet being compromised. The hacker drained over $8.4 million in assets and quickly converted the funds to DAI stablecoin.

可疑活动是由区块链安全公司的核心标记的，该公司将问题追溯到Zoth Deployer Wallet被妥协。这位黑客排出了超过840万美元的资产，并将资金迅速转换为Dai Stablecoin。

The incident began around 3:30 PM (GMT+3) when a suspicious address upgraded one of Zoth’s core contracts, according to Unal, adding that the time difference might vary depending on the time zone.

根据Unal的说法，该事件始于下午3:30（GMT+3），当时可疑地址升级了Zoth的核心合同之一，并补充说，时间差可能会因时区而异。

Later, this upgrade was revealed to be a replacement of a secure contract with a malicious version, granting the attacker control over the system.

后来，该升级被发现是用恶意版本的安全合同的替换，从而授予了攻击者对系统的控制。

“This method bypassed standard security mechanisms and gave full and immediate control over user funds,” Unal noted.

Unal指出：“这种方法绕过了标准安全机制，并对用户资金产生了全面而直接的控制。”

The new unlinked address quickly moved the stolen funds and began converting them. According to Cyvers, the attacker quickly swapped the assets into DAI and transferred them to another wallet.

新的未链接地址迅速转移了被盗的资金，并开始转换它们。据Cymers称，攻击者迅速将资产交换为DAI，并将其转移到另一个钱包中。

Later, blockchain firm PeckShield reported that the attacker swapped the DAI for Ether (ETH). The new address used for the swap was not linked to any centralized exchange or DeFi protocol.

后来，区块链公司Peckshield报告说，攻击者将DAI换成Ether（ETH）。用于交换的新地址没有链接到任何集中式交换或FEFI协议。

The incident occurred despite the presence of a multisig setup for the admin key, which usually requires multiple parties to authorize any significant changes to the protocol. However, in this case, it appears that the attacker managed to gain access to the admin key and executed the upgrade without authorization from other parties in the multisig.

尽管存在用于管理密钥的Multisig设置，该事件还是发生了，通常需要多方授权对协议进行任何重大更改。但是，在这种情况下，攻击者似乎设法访问了管理密钥并执行了升级，而无需在Multisig中其他方面授权。

The admin key is a crucial security component of any DeFi protocol, as it grants the holder the highest level of authority over the protocol's operations.

管理密钥是任何FEFI协议的至关重要的安全组件，因为它使持有人对协议运营的最高授权水平。

The exploitation of this key signifies a severe breach of security and a significant setback for the DeFi ecosystem.

对此键的开发表明，严重违反了安全性和对Defi生态系统的重大挫折。

As of yet, there is no confirmation yet on whether user funds will be recovered. Zoth protocol stated it is investigating the issue. The platform promised to release a full report once the internal review is complete.

到目前为止，尚无确认是否会恢复用户资金。 Zoth协议指出，它正在研究该问题。该平台承诺在内部审查完成后发布完整的报告。