Artificial intelligence is becoming increasingly personal.
Every conversation, document, calendar event, and email helps AI systems build a richer understanding of the people using them. This persistent context is what makes modern AI assistants more useful over time. It is also what makes protecting personal information more important than ever.
Today, we're introducing **automatic PII (Personally Identifiable Information) redaction** as a new capability within ZetaChain's privacy architecture, helping developers build AI applications that retain useful context while minimizing unnecessary exposure of sensitive user information.
## AI Needs Context. Not Identity.
Most AI applications don't need to know who you are.
They need to understand relationships, continuity, and intent—not necessarily your legal name, phone number, email address, or home address.
Yet in many AI workflows, personally identifiable information is passed between models and applications simply because it exists inside the conversation. Over time, these details accumulate across multiple services, creating an expanding collection of sensitive user data that many applications never actually need.
As AI agents become more capable and increasingly collaborate across models, applications, and workflows, this challenge only becomes more significant.
## Automatic PII Redaction
Automatic PII redaction helps address this problem by identifying and protecting sensitive information before it is shared with AI models or external services.
Personal information such as names, email addresses, phone numbers, physical addresses, payment details, government-issued identification numbers, and other common forms of PII can be automatically detected and replaced with privacy-preserving placeholders or encrypted references.
The AI still receives the context necessary to complete its task.
The unnecessary identity information does not.
For many workflows, this distinction is enough to preserve functionality while substantially reducing unnecessary data exposure.
## Privacy by Design
PII redaction is not intended to replace encryption, permissions, or user ownership. It complements them.
At ZetaChain, we believe privacy should be part of the underlying AI infrastructure rather than an afterthought applied once data has already been collected.
Automatic PII redaction represents another layer in that architecture. Together with encrypted memory, programmable permissions, wallet-based identity, and user-controlled data access, it helps developers build AI applications that are private by default rather than private by policy.
Each layer reduces unnecessary trust assumptions while allowing AI systems to remain intelligent, contextual, and useful.
## Building Toward Private AI
This release is part of a broader vision for how AI infrastructure should evolve.
As AI agents begin managing workflows, coordinating with one another, and maintaining long-term memory, users should not have to choose between personalization and privacy. Applications should receive only the information required to perform a task—and nothing more.
We believe the future of AI will be defined not only by more capable models, but by better infrastructure for identity, permissions, and memory.
Automatic PII redaction is one step toward that future, making it easier for developers to build AI applications that protect users by default while preserving the context that makes modern AI possible.
Choosing an interoperability stack requires weighing pure messaging against full application platforms.
Start Building with ZetaChain documentation to test the universal application workflow.
A zetachain vs chainlink ccip comparison reveals two distinct approaches to building across networks. Chainlink CCIP functions as a messaging and infrastructure layer that uses oracle networks to securely move data and tokens between smart contracts. In contrast, ZetaChain provides a universal Layer-1 blockchain with an application platform architecture called zEVM. This allows developers to deploy smart contracts that natively manage assets and data on both EVM and non-EVM chains like Bitcoin. While CCIP excels at high-security message passing, ZetaChain enables unified liquidity and native programmability for chains that lack their own smart contract logic. As noted in recent blockchain research, choosing between these models depends on whether a project needs a secure bridge or a sovereign execution environment for its universal applications.
ZetaChain vs Chainlink CCIP at a glanceChoosing between ZetaChain and Chainlink CCIP depends on your project goals. ZetaChain is a full platform for apps. It lets you build tools that work on many chains at once. Chainlink CCIP is a messaging tool. It helps move data and tokens from one place to another. Both help with inter-chain links but work in very different ways. Knowing these differences helps you pick the right tool for your app.
Platform versus protocolZetaChain acts as a universal layer for AI and Web3. It uses a virtual machine called zEVM to run smart contracts. This allows you to deploy code in one spot that reaches every linked network. You get unified and portable memory across every model, app, and agent. This makes it a sovereign memory layer for AI. It is built to help devs manage private data and money without needing new systems.
Chainlink CCIP works as a bridge for messages and data. It does not host its own apps or state. It is mainly a way to send info between chains that already exist. A uniform protocol is often needed to link different blockchain systems. CCIP provides a standard way to move tokens and facts. But it does not provide a single place to run your app's main logic.
Security and network trustSecurity models vary between these two systems. ZetaChain uses a Proof-of-Stake model with over 70 validators. This provides a decentralized path for inter-chain work. It relies on a large group of nodes to keep the network safe. Chainlink CCIP relies on oracle networks to verify data. These networks act as a middle layer to watch and report on chain events. Both aim to keep your data safe during transfers.
Experts note that decentralized frameworks are vital for safe blockchain use. Risks in these systems can lead to big losses if not handled well. You can read about the ZetaChain design for inter-chain work to see how this trust works. Using a decentralized group of nodes helps reduce the risk of a single point of failure. This is key for apps that handle high value or private data.
Support for native BitcoinZetaChain provides native support for the Bitcoin network. It uses TSS tech to let smart contracts manage Bitcoin directly. This means you can build apps that use BTC without using wrapped versions. It helps create unified liquidity across many chains. This is a big plus for DeFi tools that want to tap into Bitcoin's value. You can build once and reach users on both EVM and non-EVM chains.
Chainlink CCIP does not offer this native support. It focuses more on moving assets between EVM-ready chains. If you want to use Bitcoin with CCIP, you often need to use wrapped tokens. This can add extra steps and risks for your users. ZetaChain's approach is more direct. It allows for native inter-chain work that includes chains like Bitcoin and Solana from the start.
Feature
ZetaChain
Chainlink CCIP
Core Design
Application platform (L1)
Messaging and bridge layer
Execution
On-chain zEVM smart contracts
Off-chain oracle networks
Native Bitcoin
Full support via TSS
No native support
Security Model
Proof-of-Stake (70+ nodes)
Oracle-based trust
Primary Goal
Unified app and AI memory
Secure data and token transfer
Ideal Use Cases
AI agents and unified DeFi
Bank and token transfers
What is the architectural difference?
Conceptual comparison: ZetaChain centralizes application execution and state on zEVM, while CCIP delivers messages between separately deployed contracts.
Platform versus protocolZetaChain and Chainlink CCIP serve different roles in the blockchain world. ZetaChain is an app platform. It acts as a full Layer-1 network where teams can build and run code. Chainlink CCIP is a messaging protocol. It moves data and tokens between two different chains but does not host the code itself. This is the main point when looking at zetachain vs chainlink ccip for your next project.
Because ZetaChain is a platform, it provides a place for state to live. Builders use the ZetaChain EVM (zEVM) to create smart contracts that talk to many chains at once. This setup is a unique interoperability design because it keeps the logic in one place. But CCIP requires teams to set up and manage contracts on every chain they want to use. This makes ZetaChain a true universal layer for apps.
Where business logic livesWhen you use Chainlink CCIP, your app's logic is spread across many networks. You must manage how these parts talk to each other through messages. This can make your work hard as you grow and add more chains. A secure and decentralized framework is needed to make sure these messages are safe. CCIP uses an oracle network to check and move this data between separate chains.
ZetaChain changes this by letting you keep all your logic on one chain. You write your contract once on ZetaChain. Then it can control assets on Bitcoin, Ethereum, and other networks from that single spot. This creates unified liquidity since the state and assets are not split up. This model helps teams build fast without worrying about how to sync data across many spots. It acts as a sovereign memory layer for AI and web3 apps.
This single-point logic is vital for AI agents that need to store data. ZetaChain 2.0 offers a native Private Memory Layer. This lets AI apps keep a lasting state that follows the user across any model or app. Messaging protocols like CCIP are not built to hold this kind of lasting memory. They only move data from one point to another without storing it in a central, secure way.
Security and native chain supportThe two systems also use different ways to keep things safe. Chainlink CCIP relies on oracle networks to secure its message transfers. ZetaChain uses an economic Proof-of-Stake model. It has over 70 validators that work together to reach a consensus on the state of the network. This model offers a strong way to reduce possible risks in a world with many chains.
One big difference is how they handle chains like Bitcoin. ZetaChain has native support for Bitcoin through a system called TSS. This lets you build apps that use real Bitcoin directly without using wrapped tokens. Chainlink CCIP is mainly for chains that already support smart contracts. For teams that want to use Bitcoin or Solana alongside Ethereum, ZetaChain offers a more direct and native path. This makes it easier to build apps that reach the widest group of users.
How should developers choose an interoperability stack?Choosing the right tools for your app is a big task. The choice between ZetaChain vs Chainlink CCIP shifts how you manage data and assets. Both systems help chains talk, but they use different paths. Your team needs to look at your app's core needs before you pick a base. This choice will set your path for years as you grow.
Check your asset and chain needsFirst, look at which networks your app must reach. If you need to use Bitcoin or Solana without a bridge, you need a system that supports them. ZetaChain provides native Bitcoin support so you can write code that works with real BTC. Other tools like Chainlink CCIP focus on moving messages between EVM chains. They do not have the same native support for non-EVM assets. You can learn more about this in our look at ZetaChain's unique interoperability architecture and how it works.
ZetaChain acts as a universal layer for your code. You can build one app that touches every chain you need. This saves time and cuts down on the work your team has to do. If your goal is to reach users on many chains, a unified system is often the best path. It helps you keep your code in one place while your app reaches out to the whole world. This is a key part of building a great user flow.
Compare the safety modelsTrust is the most important part of any system that moves value. A secure and decentralized framework is a must for safe data flow. ZetaChain uses a Proof-of-Stake model with more than 70 nodes. These nodes work to keep the chain safe and open. This setup is spread out so that no single point can fail. It provides a strong base for apps that handle big assets or private data.
In contrast, Chainlink CCIP relies on its own oracle network to pass data. This system has a long track record of safe use across the space. Both models aim to stop bad actors, but they use different trust paths. You should pick the one that fits your own risk plan. A spread-out model with many nodes offers a clear and open way to check that everything is working well. This helps your team and your users sleep better at night.
Check state and memory needsDo you want to run one contract that controls many chains, or just send a few messages? ZetaChain lets you build on its zEVM platform to manage assets on many chains at once. This creates a unified pool of funds that flows where it is needed most. Chainlink CCIP is built as a messaging layer to send data and tokens. It does not offer a place to host your whole app's logic in one spot.
If you plan to use AI, your needs will be even more clear. ZetaChain's new 2.0 layer offers a private memory space for AI apps. This is a unique feature that other tools do not have right now. It helps AI agents store data and act as interoperable networks in a safe way. To get started with these tools, you should look at the full developer docs for more help. This will show you the best way to set up your new system.
Map your asset needs. List every chain your app needs to touch and check if they are all EVM or if you need non-EVM help.
Select your state model. Decide if you want one main contract to rule every chain or if you want to sync many small pieces of code.
Verify Bitcoin support. Confirm if your app needs to hold or spend native BTC, as this needs a certain type of platform to work.
Test the cost and speed. Look at how much it costs to send data and how long those steps take for users to see.
Check for AI memory. Think about if your app will need to store private data or route to AI models as you build more features later.
Review the ZetaChain docs and prototype one end-to-end user flow before choosing your production stack.
How do the developer workflows compare?Comparing how developers work with ZetaChain and Chainlink CCIP shows two clear paths. ZetaChain acts as a full app platform. Chainlink CCIP serves as a messaging layer. This choice shapes how teams build, test, and keep their code on many networks.
Building on the ZetaChain platformOn ZetaChain, you write smart contracts directly on its own network using zEVM. This lets you create apps that manage assets on many chains from one place. This setup, known as ZetaChain's unique interoperability architecture, means you do not need to put new code on every network you use. For example, you can build apps that work with Bitcoin even though Bitcoin has no smart contracts. This saves time and reduces the work needed to keep code in sync.
Developers use common tools like Hardhat or Foundry to write and test their contracts. Since ZetaChain is its own blockchain, you can test your logic in one space. This is faster than testing messages between many separate testnets. Standardized protocols are needed to make sure these contracts work well together. ZetaChain gives you a simple way to handle these actions without complex message passing.
Using Chainlink CCIP for messagingChainlink CCIP works by sending data and tokens between chains. When you use CCIP, you often keep your app's logic on each chain you want to connect. You then use the CCIP interface to send messages between them. This fits teams that want to keep logic on one chain like Ethereum. They can still reach other networks using CCIP. But this path means you must manage and secure many copies of your code.
The workflow for building interoperable applications with CCIP involves learning its messaging patterns. You must handle how messages are sent, received, and checked by oracle networks. This adds a layer of detail to your code. You also need to manage gas costs on both the start and end chains. CCIP tries to make this easy with its gas system, but it still needs careful planning to avoid failed trades.
Monitoring and maintenance trade-offsMonitoring your app on ZetaChain is like watching any other Layer-1 network. You check the status of your contracts and your unified liquidity. Because everything happens in one place, it is easier to track the steps of a user's action. A secure and decentralized framework helps ensure that these actions are processed well. You do not need to wait for messages to pass through many middle steps to see the final result.
With Chainlink CCIP, monitoring is harder because you must watch many chains at once. You need to check that a message sent from one chain arrived and worked on the next one. If a failure occurs, finding where it happened takes more effort. You also have to track the status of the oracle networks that secure your messages. This setup means you must update and patch contracts on every chain. This can increase the risk of errors over time.
ZetaChain provides a single place to write and run code for all chains.
Chainlink CCIP acts as a bridge for data and tokens between existing apps.
ZetaChain supports non-EVM networks like Bitcoin natively.
CCIP requires managing code on every chain you want to use.
How do the security models differ?ZetaChain uses a Proof-of-Stake system to protect the network. This setup relies on 70+ nodes to check and confirm every move. Each node must stake tokens to join. If a node tries to cheat, it loses its stake. This creates a strong link between safety and money. A secure and shared system helps make sure these moves stay valid across other networks.
Economic Proof-of-Stake vs oracle networksChainlink CCIP takes another path for its safety. It uses a network of oracles to send data. These oracles have a long track record of keeping funds safe. But they rely on their own group of nodes to check data. ZetaChain acts as a full blockchain. It handles all safety on its own Layer-1. This means the trust stays within a single, shared group of nodes. Both models work well, but they ask users to trust other parts of the tech stack.
Validation and trust assumptionsTrust is key in any inter-chain setup. When you use ZetaChain's unique design, you get a single source of truth. The chain itself checks every move. You do not need an outside party to pass your data. This model is built for the sovereign memory layer for AI. It keeps all data in one place so it stays safe and easy to find. CCIP uses a second network to watch for risks. This group looks for odd moves and stops them if they look wrong.
How they handle finality and speedZetaChain offers fast speed for all moves. Once a move is done on ZetaChain, the state is changed for all linked apps. CCIP depends on the speed of the source and target chains. This can add wait times for users. Builders using CCIP must account for these delays. On the other hand, the universal layer approach lets apps react to data as soon as the block is signed. This speed is vital for apps that need fast data flow, such as AI agents using shared memory.
Developer security dutiesBuilders have to think about their own tasks too. ZetaChain lets you write code that runs in one spot. You do not have to manage data on many chains at once. This makes it easier to keep your app safe. It reduces the spots where bugs can hide. CCIP is a sending tool. You must make sure your messages reach their target. You also have to handle what happens if a chain stops working. Using a universal layer helps you build fast with fewer risks to manage.
Builders also have to look at rate limits and controls. CCIP has built-in limits on how much value can move at once. This helps stop large thefts if a bug is found. ZetaChain lets you set your own rules within your smart contracts. Since you build on a full Layer-1, you have total control over how your app behaves. You can build custom safety checks that fit your exact needs. This choice is part of why ZetaChain is seen as a universal layer for AI and Web3. It gives you the tools to build safe, complex apps that can scale across the whole network.
When is ZetaChain the better fit?Choosing between ZetaChain and Chainlink CCIP depends on the goals of your project. Chainlink CCIP works well for simple data and token transfers between networks. But many teams find that ZetaChain is the better choice when they need a full platform to build and run apps. It provides a layer for logic that can reach every linked network at once.
Projects needing one stateBuilders who want to manage a single state across many networks should choose ZetaChain. With its universal layer, you only need to deploy your smart contracts once. This move removes the need to keep up other versions of your code on every network you support. It makes it easy to control assets and data because everything stays in sync in one place.
Using a joining protocol helps teams build apps that work well across other chains. This one model is a key part of ZetaChain's unique interoperability architecture. It allows you to build a single hub for your users. They can work with your app from any wallet without moving their funds to a new chain first.
Native Bitcoin and non-EVM appsIf your project needs to use native Bitcoin, ZetaChain is the best fit. It is the only major platform that allows you to write smart contracts that control Bitcoin. You do not need to use wrapped assets or complex bridges that add risk. This native support also extends to other networks like Solana, which gives you a wider reach than link tools.
A spread out framework is vital for making these inter-chain actions safe. ZetaChain uses a network of over 70 nodes to secure these tasks. This model ensures that your app can talk to non-EVM chains while keeping a high level of safety. It is a strong tool for builders who want to tap into the large pool of Bitcoin users.
AI and private memory solutionsTeams building AI tools should look at ZetaChain for its private memory layer. This feature allows you to store and manage data that stays private and easy to move. Most other networks only focus on moving tokens, but ZetaChain acts as a memory layer for models and agents. It helps you build apps that can learn and remember across other places.
You can use the AI Portal to route tasks to other models based on what your app needs. This system makes it easy to add AI features to your blockchain tools. It gives you a way to sell your models while keeping control of the data. This focus on memory and AI makes it a unique fit for the next wave of smart apps.
Explore the ZetaChain ecosystem to see how builders apply universal application architecture.
Frequently Asked QuestionsWhat is the architectural difference between ZetaChain and Chainlink CCIP?ZetaChain is a Layer-1 app platform that hosts smart contracts and stores state. This allows builders to keep business logic in one place while connecting to other networks. Chainlink CCIP is a messaging protocol that moves data and tokens between different spots. According to Chainlink, CCIP is mainly a tool for base layer work and data transfer. ZetaChain provides a unified spot for code, while CCIP requires teams to manage code on every connected chain.
How does Chainlink CCIP secure data transfers between networks?Chainlink CCIP uses decentralized oracle networks to verify and move messages between different chains. This system checks that each message is valid before it reaches the final destination. A study in the National Library of Medicine notes that protocols rely on different security models like validator sets or oracles. CCIP focuses on secure data and token transfers using its proven oracle setup. This helps protect the integrity of the data as it moves through the decentralized web.
Can developers build apps on ZetaChain that connect to many blockchains?Yes, developers can use ZetaChain to build apps that connect to many networks from a single point. This is possible through the ZetaChain EVM, which allows for unified logic and data. According to ZetaChain, the platform enables native support for chains like Bitcoin and Solana. This setup helps teams build apps that reach users on different blockchains without needing wrapped assets. It creates a sovereign memory layer for AI that works across the whole network.
What are the trade-offs between ZetaChain and Chainlink CCIP for developers?Developers choose between these tools based on where they want to keep their logic. ZetaChain allows teams to build apps with a single state that connects to many chains. This reduces the need to manage many contracts on different networks. Chainlink CCIP is a strong choice for simple data moves but requires more work to sync state. As noted by ZetaChain, its platform helps developers build apps with native AI and memory features. This unified approach can save time during the build process.
Ready to Start Building on the sovereign memory layer?Choosing a tech stack is a big step that defines how fast your team can ship and grow in the next few years. If you wait to choose your path, you will waste months on code that does not scale or work with new tools. This delay lets your rivals get a head start while you stay stuck with old systems that fail as the market moves. By starting on a sovereign memory layer today, you save time and reach more users through a single, unified app layer. The cost of doing nothing is a loss of speed that your project may never get back in this fast tech world. Use a system that handles private memory and works for all models and agents to keep your project on the right track. You can read more about ZetaChain's unique interoperability architecture to learn how it works.
Start Building with the documentation and validate your architecture in code.
Choosing an interoperability architecture is really a choice about where your application logic, state, and security assumptions will live.
ZetaChain vs Wormhole is not a comparison between two identical tools. ZetaChain is a Layer 1 blockchain where developers can deploy Universal Apps that coordinate assets, data, and calls from connected networks through one programmable environment. Wormhole is an interoperability protocol that verifies and delivers messages between applications deployed on different networks. ZetaChain can suit teams that want unified logic and state, including native Bitcoin use cases. Wormhole can suit teams that want to keep existing deployments and add verified message delivery. The right choice depends on the application's state model, threat model, operating burden, and the steps a user must complete.
This guide turns those architectural differences into a practical decision process. It focuses on what developers need to build, secure, test, and operate rather than declaring a universal winner.
Start Building with the ZetaChain documentation
ZetaChain vs Wormhole at a glanceThe fastest way to understand the difference is to ask where the core application runs. With ZetaChain, a Universal App can place its main logic and shared state on ZetaChain. Users on connected networks interact with that app through ZetaChain's connectivity layer. With Wormhole, applications generally retain contracts or services across their chosen networks and use Wormhole to carry verified messages between them.
That distinction affects far more than contract deployment. It changes how a team synchronizes state, handles failures, pays for execution, audits the system, and designs the user journey. A protocol that transports messages and a programmable Layer 1 can both enable interoperability, but they assign different jobs to the application team.
Decision area
ZetaChain
Wormhole
Primary model
Layer 1 execution environment for Universal Apps
Verified messaging and token-transfer infrastructure
Application logic
Can be concentrated in one Universal App
Often remains in contracts or services on each target network
State
Can use one shared source of application state
Applications design synchronization around delivered messages
Native Bitcoin use
Designed to support programmable interactions with native BTC
Depends on the selected Wormhole product and integrated assets
Core security question
How ZetaChain consensus, observers, and threshold signing secure the flow
How Guardians verify and attest to messages
Best initial test
Prototype one end-to-end Universal App flow
Prototype message production, delivery, verification, and recovery
Neither column removes the need for careful application security. Teams still need access controls, safe upgrade processes, monitoring, rate limits, and tested recovery paths. The useful comparison is which architecture makes those responsibilities easier to reason about for a specific product.
How do the programming models differ?A ZetaChain Universal App is a smart contract application deployed on ZetaChain. It can receive calls and assets originating from connected networks, apply shared business logic, and coordinate outcomes. This model lets a developer treat interoperability as part of the execution environment rather than building a separate messaging layer into every deployment.
That can reduce duplicated logic. For example, a lending or portfolio application may need a single view of collateral and policy rules. A shared contract can be easier to audit than several versions that must remain aligned. It can also make feature releases more consistent because the team updates the central application logic instead of coordinating many deployments.
Unified state changes the design problemState is often the hardest part of an interoperable application. A message can arrive late, arrive after another action, or fail during downstream execution. If each network keeps its own state, the application needs rules for ordering, retries, duplicate handling, and reconciliation. These are application-level concerns even when the transport layer works as designed.
ZetaChain gives teams the option to keep important state in one programmable environment. That does not eliminate asynchronous behavior at connected-network boundaries, but it can reduce how many sources of truth the team maintains. Developers still need to define what happens while an inbound or outbound action is pending and how users recover from failure.
Message delivery preserves existing deploymentsWormhole's model can be attractive when a product already has contracts on several networks. Those contracts can emit messages, receive verified messages, and take local action. The team can preserve network-specific integrations and use Wormhole as a communication layer rather than moving the main application to a new execution environment.
This flexibility also places more design work on the application. Teams decide which contracts may send messages, how a receiving contract validates them, what ordering guarantees the app needs, and how state converges. For some mature products, that control is a benefit. For a new product seeking one shared logic layer, it can become extra operational weight.
What security assumptions should developers evaluate?Security comparisons should begin with explicit assumptions, not labels. Every interoperable design combines protocol security with application code, administrative controls, upgrade mechanisms, relayers or operators, and connected-network behavior. A fair review maps each component and asks how a failure could affect funds, state, or availability.
ZetaChain security modelZetaChain uses proof-of-stake consensus for its Layer 1. Validators participate in consensus, while observer components watch connected networks and report relevant events. Threshold signature schemes allow the network to control connected-network accounts without one node holding a complete private key. Economic penalties can apply to validator misconduct under the protocol's rules.
For an application team, the review should cover more than consensus. It should examine Universal App permissions, contract upgrade controls, inbound call validation, outbound action limits, and the handling of assets while an action is pending. Teams should also understand how connected-network observations become finalized actions and which events can pause or delay execution.
Wormhole security modelWormhole uses a Guardian network to observe and attest to messages. Applications verify the resulting attestations before acting. This creates a clear integration boundary, but developers must still validate the message's emitter, source context, payload, and replay properties. Accepting a valid attestation is not the same as confirming that every requested application action is safe.
Teams evaluating Wormhole should review the current Guardian set and threshold, the product-specific verification flow, contract upgrade controls, relayer behavior, and recovery procedures. They should also determine how the application responds when delivery is delayed or a destination call reverts.
Build a threat model around the whole flowA useful threat model traces one user action from the first signature to the final state change. Identify every contract, key, role, network, message, and off-chain service involved. Then test compromised administrators, malformed payloads, duplicate messages, delayed finality, destination reverts, price manipulation, and service outages.
Do not assume blockchain transactions are universally irreversible. Protocol-level exceptions, governance actions, upgrades, and reorganizations can affect outcomes. Likewise, do not describe all smart contracts as immutable. Upgradeable proxy patterns and privileged controls are common. Documenting these realities makes the comparison more useful and the final application safer.
How does each approach shape user experience?Users do not experience an architecture diagram. They experience wallet prompts, wait times, gas requirements, failed actions, and balances that either make sense or do not. The best technical design is the one that supports a clear journey without hiding material risks.
Count user-visible stepsStart by counting signatures, approvals, network switches, and transactions for the most important flow. A Universal App can often present a more unified interaction because core logic and state live in one place. The exact experience still depends on the connected network, asset, wallet, and application design.
A Wormhole-based application can also offer a streamlined interface, especially when relayers and product tooling handle delivery well. However, an app with contracts and state on several networks may need more visible coordination. Developers should test the full journey instead of inferring UX from the protocol alone.
Design the pending and failure statesInteroperable actions are not always instant. Users need to know when an action is submitted, observed, verified, executed, or waiting for recovery. A generic spinner is not enough. The interface should show a status that maps to the actual system and provide a safe next step.
For ZetaChain, teams should explain when an inbound action reaches the Universal App and when an outbound action completes. For Wormhole, teams should explain message attestation, delivery, and destination execution. In either case, the product needs idempotent retry logic so a user cannot accidentally trigger the economic action twice.
Measure UX under stressPrototype testing should include slow finality, unavailable relayers, high gas, rejected wallet prompts, and destination reverts. Record completion rate, time to completion, support requests, and recovery success. These results often reveal more than a feature checklist. They show whether the architecture can support a product people will trust.
Teams should also decide who pays each execution cost and how that is communicated. Abstracting gas can improve usability, but it creates operational and abuse-prevention requirements for the sponsor. Clear limits and monitoring are essential.
A practical evaluation process for your teamA short prototype can expose architectural tradeoffs before they become expensive. Use the same representative flow for both approaches and compare the evidence.
Define the state model. List the data that must remain consistent and identify the source of truth. Decide whether one shared state layer or network-local state better fits the product.
Map required networks and assets. Confirm current support in official documentation. Include native assets, tokens, contract calls, finality needs, and any network-specific limitations.
Write the threat model. Trace keys, roles, contracts, messages, observers, Guardians, relayers, and upgrade paths. Define loss limits and pause conditions.
Build one end-to-end flow. Use realistic contracts and a real front end. Avoid a demo that tests only a happy-path message.
Inject failures. Delay delivery, duplicate requests, revert destination calls, and interrupt services. Verify that retries are safe and the user sees an accurate status.
Measure the user journey. Count prompts, transactions, network switches, completion time, and recovery steps. Test with people who did not build the prototype.
Estimate operating work. Compare monitoring, incident response, upgrades, liquidity needs, support burden, and the number of deployments the team must maintain.
The result should be a written architecture decision record. It should name the chosen model, rejected alternatives, assumptions, measured tradeoffs, and triggers that would cause the team to revisit the decision.
When is ZetaChain the better fit?ZetaChain is a strong fit when the product benefits from one programmable environment and shared application state. This is particularly relevant for new applications that do not want to deploy and synchronize a full set of contracts across every target network. It can also suit products that need to coordinate native assets, including native BTC, through a Universal App.
A team may prefer ZetaChain when its core business logic should be consistent for every user. One central contract can reduce version drift and make audits easier to scope. Developers can focus on the application's rules while ZetaChain provides the connectivity and execution framework.
Use cases that favor a Universal AppApplications that need one shared account, policy, or portfolio state.
Products that want programmable access to native Bitcoin alongside other connected assets.
New builds seeking to minimize duplicated contract logic.
User journeys where reducing network-specific steps is a primary product goal.
Teams that want one core environment for monitoring and upgrades.
This choice still requires careful engineering. Developers need to understand ZetaChain's connected-network model, contract interfaces, gas behavior, and failure handling. The best next step is to review the ZetaChain developer documentation and build a small flow that represents the hardest part of the intended product.
When is Wormhole the better fit?Wormhole can be the better fit when a team intends to keep its existing contracts and state on their current networks. If the product needs verified messages or token transfers between those deployments. Adopting a messaging protocol may require less architectural change than moving core logic into a new execution layer.
This can matter for mature protocols with network-specific features, established liquidity, completed audits, or governance processes tied to existing contracts. Wormhole may let the team add communication while preserving those investments. It can also suit applications whose local components should remain independent and only exchange a limited set of messages.
Use cases that favor messagingExisting applications adding communication between current deployments.
Products that require network-specific contracts and local state.
Teams prepared to manage message validation, ordering, retries, and reconciliation.
Integrations centered on a Wormhole product already supported by the application stack.
The team should still prototype the complete delivery path and audit receiving-contract logic. A verified message can be authentic while the requested application action is unsafe. Strict emitter checks, payload validation, replay protection, rate limits, and tested recovery procedures remain essential.
Frequently asked questionsIs ZetaChain a bridge like Wormhole?No. ZetaChain is a Layer 1 blockchain where developers can deploy Universal Apps with shared logic and state. Wormhole is an interoperability protocol centered on verified messaging and related token-transfer products. Both can connect activity across networks, but they give the application team different programming and operating models.
Can ZetaChain Universal Apps work with native Bitcoin?ZetaChain is designed to let Universal Apps coordinate native BTC without requiring developers to deploy a smart contract on Bitcoin. Teams should confirm current network support, interfaces, and limitations in the official documentation before designing a production flow.
Which option is more secure?There is no useful one-word answer. ZetaChain and Wormhole use different security models, and application security also depends on contract code, permissions, upgrades, operators, relayers, and recovery controls. Build a threat model for the full user action and compare assumptions against the product's risk limits.
How should a team choose between ZetaChain and Wormhole?Start with state. If the product benefits from one programmable environment and unified state, prototype a ZetaChain Universal App. If it must preserve network-local contracts and state, prototype Wormhole messaging. Then compare security assumptions, user steps, failure recovery, and operating work with the same real product flow.
Start building your Universal AppThe best ZetaChain vs Wormhole decision comes from a working prototype, not a feature checklist. Define your state model, test the hardest user flow, inject failures, and measure the work your team must own. If one programmable environment and native asset access fit your product, use the official documentation to build the first Universal App flow.
Choosing between interoperability architectures is not simply a matter of comparing network counts. The useful question is where your application logic should run, how state should be coordinated, and which failure modes your team is prepared to operate. For developers evaluating ZetaChain vs Axelar, that distinction leads to two different application designs. This guide turns that difference into a concrete architecture and prototype decision.
Start Building with ZetaChain documentation and test a Universal App against your real workflow.
ZetaChain provides a universal execution environment where a Universal App can coordinate assets and calls from connected networks through one smart contract. Axelar primarily provides infrastructure for passing messages between contracts deployed in different environments. Both approaches can connect applications and users, but they produce different contract topologies, operational responsibilities, and user experiences.
This guide focuses on those practical differences. It gives engineering teams a decision framework, security questions, and a prototype plan rather than treating the choice as a feature checklist.
ZetaChain vs Axelar: the architectural differenceThe central difference is execution placement. With ZetaChain, developers can put shared application logic and state in a Universal App on ZetaChain. Users interact from connected networks, while the Universal App coordinates the workflow. With a message-passing architecture, developers commonly deploy and maintain application contracts in each target environment, then use messages to coordinate actions between them.
Decision area
ZetaChain approach
Axelar approach
Primary abstraction.
Universal smart contract and shared execution.
Message transport between application contracts.
Business logic.
Can be centralized in a Universal App.
Usually distributed across destination contracts.
State design.
Shared state can live in one execution environment.
State coordination is designed across deployments.
Developer focus.
Contract behavior, connected calls, and asset handling.
Message schemas, remote contracts, and delivery handling.
Good first question.
Can one contract own the workflow?
Must logic execute in each destination environment?
Neither abstraction eliminates distributed-systems work. Calls can fail, destination conditions can change, and applications still need explicit authorization, accounting, observability, and recovery policies. The architecture changes where teams express and operate those controls.
Where does application logic run?Application logic runs either in a shared execution environment or across contracts deployed in destination environments. ZetaChain lets a Universal App own coordinating logic and state in one place. Axelar-style message coordination commonly keeps execution local, requiring teams to manage remote contracts, message formats, and distributed state.
Execution-centric designA Universal App places the coordinating contract on ZetaChain. Instead of duplicating the full application across every connected environment, the team can encode core rules once and expose a consistent interaction model. This can be valuable for applications that need a unified account, portfolio, position, or policy across different networks. Developers can review the broader platform model in ZetaChain solutions.
Consider a portfolio application that accepts a user action from one network, updates shared allocation logic, and triggers an action involving an asset elsewhere. A Universal App can make the shared allocation state the center of the workflow. The developer still defines permissions, limits, and recovery behavior, but does not need a separate source of truth for each deployment.
Message-centric designIn a message-centric design, application contracts on separate networks exchange instructions. This is useful when the intended behavior truly must execute inside each destination environment. It also lets teams preserve existing destination contracts and add coordination around them.
The tradeoff is that the application owns more distributed state. Teams need to version message formats, authenticate senders, handle duplicate or delayed messages, and reason about partial completion. A successful send is not the same thing as a successful business outcome, so the destination contract must validate current conditions before acting.
A practical testDraw the application as a state machine. If most transitions can be owned by one contract and connected interactions are inputs or outputs, universal execution deserves a prototype. If each destination must own distinct rules or state transitions, message-based coordination may be a more natural fit.
How each architecture changes the developer workflowThe architecture changes how many contracts, configurations, releases, tests, and operational controls a team must manage. Universal execution can concentrate core logic and invariants. Message-based coordination distributes responsibility across deployments and makes compatibility, delivery handling, and partial completion central engineering concerns.
Architecture becomes tangible in the repository, deployment pipeline, and incident runbook. Before selecting infrastructure, estimate the number of contracts, configuration objects, privileged roles, and release steps required for the smallest production workflow. Use the ZetaChain whitepaper alongside the documentation when evaluating protocol assumptions.
Contract topology and releasesWith a Universal App, a team can often concentrate core logic into one contract system. That can reduce duplicated releases, but it also makes the Universal App an important coordination point that demands careful review and testing. Smart contracts may use upgradeable proxy patterns, so teams should document upgrade authority and safeguards rather than assuming all deployed code is strictly immutable.
A distributed deployment model introduces remote contract addresses, per-environment configuration, and compatibility requirements. Every message schema change may require coordinated releases. Teams need a policy for older senders, older receivers, and environments that cannot upgrade at the same time.
Testing and local reasoningUniversal execution can make core state transitions easier to test together. Engineers can focus on one set of invariants, then test connected inputs and outbound effects around that center. Message-based systems require strong contract-level tests plus integration tests for ordering, retries, authentication, and partial completion.
In either model, test adversarial paths. Simulate stale state, insufficient gas, paused contracts, unexpected callers, destination reverts, and repeated requests. Do not make a protocol-level assumption that every transaction is universally irreversible. Your application should define what finality it requires and how exceptions affect user-visible state.
Operations and observabilityOperational dashboards should represent business workflows, not only transactions. Track the initiating action, each intermediate state, completion, and any compensating action under one correlation identifier. An operator should be able to answer what happened to a user request without manually searching multiple explorers.
A practical architecture decision frameworkA sound ZetaChain vs Axelar decision starts with the application's state owner, required execution locations, failure paths, and operational surfaces. Teams should measure these factors with one representative prototype instead of selecting infrastructure from broad labels or network-count comparisons.
Define the state owner. List every state variable and decide which contract must be authoritative. If the answer repeatedly points to one shared application state, prototype a Universal App.
Map execution requirements. Identify actions that truly must run in a destination environment. Separate those from actions that are placed there only because of an inherited architecture.
Model failure paths. Write down what happens if a call is delayed, rejected, duplicated, or only partly completed. Specify retry, refund, timeout, and manual recovery policies.
Count operational surfaces. Estimate deployments, keys, roles, configurations, message schemas, monitoring rules, and emergency controls. Complexity should be measured, not assumed.
Evaluate security assumptions. Document protocol assumptions and application-level controls. Include authorization boundaries, upgrade authority, rate limits, and asset exposure.
Prototype one vertical slice. Build the smallest end-to-end user journey on test environments. Instrument every stage and compare implementation effort, latency, and recovery behavior.
Explore ZetaChain grants if your prototype needs ecosystem support.
This process prevents a common mistake: selecting an architecture from a broad label, then discovering that the application's state model does not fit it. The best comparison uses the actual workflow your team must ship.
What security assumptions should teams evaluate?Teams should evaluate trust boundaries, authorization, upgrade controls, replay protection, ordering, partial completion, and economic exposure. Protocol infrastructure can authenticate or deliver an interaction, but application contracts still determine whether it is valid and how safely the workflow responds to failure.
Security analysis should separate protocol responsibilities from application responsibilities. Infrastructure can authenticate or deliver an interaction, but the application still decides whether the requested action is valid. Authorization, limits, accounting, and safe failure behavior remain developer concerns.
Trust and authorization boundariesDocument who can initiate each action and how the receiving contract recognizes that authority. Avoid treating a valid transport-level message as sufficient permission for every business operation. Validate the expected sender, source context, payload, nonce, and current application state.
Also inventory administrative controls. Many deployed protocols and applications retain admin keys, guardians, or governance mechanisms. Describe these controls precisely instead of broadly labeling a system fully decentralized. For upgradeable components, record who can upgrade them, whether a delay applies, and how users learn about changes.
Replay, ordering, and partial completionConnected workflows can be asynchronous. Applications should be idempotent where possible, meaning repeated delivery does not repeat a harmful business effect. Store processed identifiers, validate sequence rules when ordering matters, and make timeout behavior explicit.
Partial completion deserves its own threat model. If one step succeeds and a later step fails, decide whether to retry, compensate, pause, or require operator review. A clear state machine is safer than attempting to hide intermediate states.
Economic limitsSet rate limits and exposure caps appropriate to the workflow. Monitor unusual value, frequency, destinations, and caller patterns. Emergency controls should be narrow, documented, and tested. The goal is not to claim zero trust; it is to understand each trust boundary and reduce the impact of failure.
Which architecture fits your application?Universal execution fits applications that benefit from a shared source of truth and consistent workflow. Message-based coordination fits cases where logic must execute locally or preserve mature destination contracts. Some systems combine patterns, but authority and state ownership must remain explicit.
When universal execution is compellingZetaChain is a strong candidate when an application benefits from one source of truth and a consistent user-facing workflow. Examples include a universal account, unified liquidity logic, portfolio management, payments, and applications that need to coordinate assets including native Bitcoin. The design can let developers build core behavior once while serving users from connected environments.
This approach can also help when a team wants to minimize duplicated contracts and coordinated upgrades. The value is not merely fewer files. It is a simpler mental model for shared state and a narrower surface for core business logic.
When message-based coordination is compellingA message-based approach fits applications whose logic is inherently local to destination environments or teams that must preserve mature contracts already deployed there. It can be appropriate when each deployment needs distinct rules, governance, or composability with local contracts.
That flexibility comes with engineering obligations. Treat remote contracts and message schemas as a distributed API. Maintain compatibility policies, explicit versioning, and robust observability. If the application cannot tolerate intermediate or divergent states, account for that constraint early.
When to combine patternsReal systems can combine approaches. A Universal App may own shared policy while calling connected environments for specific effects. The important design choice is to keep authority and state ownership unambiguous. Hybrid does not have to mean unclear.
Developers can review the ZetaChain documentation to understand Universal Apps and connected contract patterns. The ZetaChain ecosystem also provides useful examples of what builders are shipping.
How to validate the choice with a prototypeValidate the choice by building one representative vertical slice, instrumenting every stage, and deliberately injecting failures. Compare contract count, configuration, privileged roles, recovery code, time to diagnosis, and user-visible outcomes. Evidence from the prototype is more useful than a generic feature checklist.
A prototype should test architecture risk, not polish. Choose one user journey that crosses a meaningful boundary and carries representative state. Define success criteria before coding so the team can compare results instead of defending its first implementation.
Build a vertical sliceImplement the smallest path from user intent to completed outcome. For ZetaChain, prototype the central Universal App state transition plus one connected input and one outbound action. For a message-based model, prototype the source contract, message payload, destination validation, and acknowledgement or recovery path.
Keep a decision log as you build. Count contract deployments, configuration values, privileged roles, SDK integrations, and custom recovery code. Record which parts of the workflow can be tested locally and which require full integration environments.
Inject failures deliberatelyDo not validate only the happy path. Pause a destination component, reject an action, send a duplicate request, change a relevant state before completion, and simulate inadequate fees. Confirm that the user sees an accurate status and that operators have an actionable alert.
Measure time to diagnosis and time to recovery. A design that looks concise in a diagram may be expensive to operate when requests fail. Conversely, an architecture with a clear state owner can make recovery easier even when the underlying workflow remains asynchronous.
Review the result as a teamBring application engineers, security reviewers, and operations owners into the prototype review. Compare implementation complexity, security boundaries, user experience, and ongoing release burden. Select the architecture that makes the required workflow safest and easiest to reason about, not the one with the longest feature list.
Frequently asked questionsThese concise answers address the most common developer questions about ZetaChain vs Axelar, including the core architecture distinction, native Bitcoin support, and the best way to make a project-specific decision.
Is ZetaChain a bridge?ZetaChain is a Layer 1 blockchain with a universal execution environment. Its Universal Apps can coordinate connected interactions and assets through smart contracts. Evaluating it only as a bridge misses the central developer abstraction: shared application logic and state.
Is Axelar the same type of architecture as ZetaChain?No. Axelar is commonly used as message-passing infrastructure between application contracts, while ZetaChain supports universal smart contracts that can own shared logic and state. Developers should compare where execution happens and what their team must deploy and operate.
Can ZetaChain applications work with native Bitcoin?ZetaChain is designed to support Universal Apps that interact with connected assets, including native Bitcoin. Teams should verify the current supported capabilities and implementation patterns in the documentation before defining production behavior.
How should developers choose between them?Start with the application's state machine. Identify the authoritative state owner, required execution locations, failure behavior, and operational surfaces. Then prototype one representative workflow and compare complexity using evidence from the build.
Start building a Universal AppThe fastest way to resolve the ZetaChain vs Axelar decision is to test your real workflow. Model the state owner, build one vertical slice, and measure the operational burden under failure. Review what builders are shipping across the ZetaChain ecosystem, then compare those patterns with your state model.
Start Building with ZetaChain documentation and prototype a Universal App.
Choosing between ZetaChain and LayerZero is not simply a choice between two interoperability products. It is a decision about where your application executes and where its canonical state lives. It also determines how much distributed infrastructure your team must operate. In a ZetaChain vs LayerZero evaluation, start with the application architecture you need, not a feature checklist.
Start Building on ZetaChain and test whether a Universal App can simplify your most demanding workflow.
The short version: ZetaChain lets developers build Universal Apps whose core logic and state can live on ZetaChain while interacting with connected networks. LayerZero provides a messaging protocol that applications use to send information between deployments. One model centers the application on a programmable Layer 1; the other connects application components that developers deploy elsewhere.
This guide focuses on that architectural decision. It gives technical teams a practical framework for comparing implementation scope, user experience, operations, and security assumptions before committing engineering time.
ZetaChain vs LayerZero at a glanceIn brief: ZetaChain provides a Layer 1 environment where a Universal App can coordinate logic and canonical state. LayerZero provides messaging infrastructure for communication between application deployments. The right fit depends on whether your product benefits more from consolidated execution or locally deployed components.
Decision areaZetaChainLayerZeroPrimary modelUniversal Apps execute on ZetaChain and can interact with connected networksMessaging protocol connects application deployments and endpointsCore application logicCan be consolidated in a Universal App contractTypically remains in contracts deployed on destination networksCanonical stateCan be maintained on ZetaChainApplication teams determine how state is distributed and synchronizedDeployment surfaceOne central application deployment can serve interactions across supported networksApplication components generally need deployment and configuration wherever messages are receivedBest starting questionCan one application coordinate this workflow?How should existing deployments exchange messages?
The table is a starting point, not a verdict. Both approaches can support sophisticated applications. The meaningful difference is what your team must build around the interoperability layer. That difference affects contract count, upgrade coordination, observability, incident response, and the number of state boundaries engineers must understand.
How do the execution models differ?ZetaChain centers execution in a Universal AppA Universal App is a smart contract deployed on ZetaChain that can coordinate interactions involving connected networks. Instead of treating interoperability as a message sent between several copies of an application, developers can place the workflow's logic and state in one application. ZetaChain's connectivity layer and protocol components handle the interaction path.
This model can be useful when an application needs one source of truth for balances, permissions, positions, or workflow status. A developer can reason about the core state transition in one contract environment, then define how the app handles inbound calls and outbound actions. Consolidation can also make it easier to test invariants because the most important business rules live in one contract system.
ZetaChain supports native Bitcoin programmability. That matters for teams whose product needs to incorporate Bitcoin without requiring users to move through a wrapped-asset workflow first. Review the ZetaChain developer documentation for current supported networks, contract patterns, and implementation details.
LayerZero centers communication between application endpointsLayerZero is a messaging protocol. An application uses endpoints and configured pathways to communicate between contracts on different networks. The application developer decides what message is sent, how receiving contracts process it, and how the wider application maintains consistent behavior.
That model can fit a team that already operates deployments on several networks and wants those deployments to exchange information. It preserves local execution environments, but it also leaves the application team responsible for the contracts, configuration, monitoring, and state model that surround each endpoint.
The practical distinction is straightforward: messaging connects components; a Universal App can consolidate the application that coordinates them. Neither model removes the need for careful contract design, but each puts that responsibility in a different place.
Start Building with the Universal Apps documentation to compare these execution patterns against your application's hardest workflow.
Where should canonical state live?Canonical state is the authoritative record that resolves conflicting observations. For a lending product, it may be a user's debt position. For a game, it may be item ownership. For an order system, it may be the current fulfillment state. Before selecting infrastructure, teams should identify each authoritative record and decide which execution environment can change it.
A Universal App can keep the central state machine on ZetaChain. Connected-network interactions become inputs to or outputs from that state machine. This structure can reduce synchronization logic and make rules easier to audit. It can also simplify product analytics because teams have one coordinating application to observe.
A messaging design can leave state within application deployments. That gives teams control over local execution and integrations, but requires an explicit policy for ordering messages, rejecting duplicates, resolving partial completion, and reconciling state after failures. Those requirements are manageable when designed deliberately. They become dangerous when treated as edge cases after launch.
Draw the state machine before writing integration code. Mark every state transition, authorized caller, retry path, timeout, and recovery action. The resulting diagram will often reveal which architecture best fits the product.
How to choose the right architecture for your appMap the canonical state. Write down the state that must remain authoritative, such as a lending position, account permission, game inventory, or order status. If one source of truth would simplify the product, a Universal App deserves close consideration. If each deployment must remain locally authoritative, a messaging model may fit better.
Count the contracts you must deploy and maintain. Include application contracts, receiver logic, configuration, permissions, and upgrade paths. Do not compare only the first proof of concept. Compare the production system your team must operate after adding the next three networks.
Trace the user's full transaction journey. Note every wallet switch, approval, fee asset, waiting period, and recovery step. The architecture is only successful if users can complete the intended action reliably.
Define failure behavior. Decide what happens when an inbound call cannot execute, an outbound action fails, liquidity is unavailable, or an application contract is paused. Design retries, refunds, and idempotency before launch.
Review security and governance assumptions. Document validators, message verification, application permissions, administrative controls, upgradeable proxy patterns, and emergency procedures. Avoid treating any contract or transaction as universally immutable or irreversible.
Prototype the hardest workflow. Build the path with the most state, assets, and failure cases. A simple token transfer rarely exposes the operational tradeoffs that determine long-term engineering cost.
Review the Universal Apps documentation while mapping your proof of concept, including current contract patterns and supported connections.
Developer experience and operational tradeoffsArchitecture changes the work that happens after the demo. A distributed application surface can require repeated deployments, configuration management, monitoring, incident response, and upgrades. Every additional receiver and permission creates another place where configuration drift or an incomplete release can cause problems.
A Universal App can reduce that surface by consolidating core logic and state on ZetaChain. This does not eliminate operational work. Developers still need robust contract tests, observability, access controls, and explicit handling for inbound and outbound failures. It does change the unit being operated: one coordinating application rather than several application instances that must stay aligned.
Teams should compare both approaches using the same production checklist:
How many contracts, endpoints, and administrative roles will exist?
Where does canonical state live, and how is conflicting state prevented?
What must be monitored for every supported network?
How are failed operations retried, refunded, or reconciled?
How will upgrades be tested and rolled out?
What does the user need in their wallet to complete an action?
Operational cost also includes cognitive load. An on-call engineer needs to identify whether a problem originated in application logic, endpoint configuration, message verification, connected-network conditions, or a downstream integration. Fewer moving parts can shorten diagnosis, while local deployments can offer useful isolation. Measure these tradeoffs using realistic incidents, not only successful test transactions.
ZetaChain's introduction to Universal Apps explains the application model in more detail. Teams evaluating interoperability design can also review ZetaChain's approach to interoperability.
What should developers compare in the security model?Security comparisons should identify assumptions and failure domains, not declare an abstract winner. Begin by diagramming every component that can authorize, verify, relay, execute, pause, or upgrade an operation. Then ask what happens if each component is unavailable, misconfigured, or compromised.
For a messaging-based application, review the verification configuration, endpoint contracts, receiving logic, owner permissions, and every deployed application's controls. For a Universal App, review ZetaChain's validator and connectivity architecture, the Universal App contract, protocol contracts it calls, and its administrative controls.
In either design, the application remains responsible for secure business logic. Validate message or call origins, constrain permissions, protect replay-sensitive operations, use idempotent processing where appropriate, and test adversarial failure cases. If contracts use upgradeable proxy patterns, document who can upgrade them and how those powers are governed. If a workflow handles valuable assets, commission an independent audit and prepare an incident response plan.
A useful threat-model workshop assigns an owner to every failure domain and records the intended response. Include unavailable validators, delayed observations, incorrect configuration, compromised administrative keys, failed outbound execution, and unexpected connected-network reorganization. The exercise turns a broad security comparison into testable engineering requirements.
Which model fits common application scenarios?Consider ZetaChain when one application should coordinate the experienceA product needs one state model while accepting users or assets from supported networks.
The workflow includes native Bitcoin programmability.
The team wants to minimize repeated application deployments and synchronization logic.
The user experience should abstract network-specific complexity behind one application.
Consider a messaging model when existing deployments need to communicateThe product already has important local deployments and state.
Each deployment must preserve network-specific execution or integrations.
The team is prepared to operate and secure receiver contracts and configurations across its supported environments.
The application mainly needs to transmit instructions or state updates between those deployments.
Some systems can combine architectural patterns. If you consider a hybrid, define one canonical state model and make every ownership boundary explicit. Adding mechanisms without a clear reason usually increases the failure surface. A hybrid should solve a specific product constraint, not act as a substitute for choosing where critical logic belongs.
A practical proof-of-concept planBefore choosing, run a short, evidence-based evaluation. Select one user journey that touches the most difficult requirements. Implement it with realistic permissions and failure handling, then measure what your team will actually maintain.
Specify the user action, authoritative state transition, and expected final state.
List every contract and configuration required for the production version.
Implement origin validation, replay protection, retries, and refunds where applicable.
Simulate delayed delivery, failed execution, unavailable infrastructure, and a paused contract.
Record deployment steps, monitoring requirements, and upgrade procedures.
Compare user steps, engineering effort, and operational surface against your product priorities.
Score each prototype on deployment count, lines of application-specific integration code, user steps, test coverage, failure recovery, monitoring effort, and upgrade coordination. Include qualitative feedback from the engineers who build and operate the prototypes. The best architecture is the one that makes the product's hardest requirements easier to satisfy without creating unacceptable assumptions elsewhere.
This exercise produces a much stronger decision than comparing marketing terminology. It also gives the team an initial threat model and operating runbook.
Frequently asked questionsIs ZetaChain a bridge?ZetaChain is a Layer 1 blockchain designed for Universal Apps. Its model lets an application execute and maintain state on ZetaChain while interacting with connected networks. That is broader than a bridge whose primary purpose is moving assets between environments.
Is LayerZero a blockchain?LayerZero is a messaging protocol rather than a Layer 1 application-execution blockchain. Developers use its endpoints and messaging pathways to connect application contracts deployed in different environments.
Does ZetaChain replace every application deployment?Not necessarily. A Universal App can consolidate core logic, but the right design depends on required integrations, supported networks, local execution needs, and product constraints. Prototype the hardest workflow and verify current support in the documentation.
What is the biggest ZetaChain vs LayerZero difference?The central difference is execution architecture. ZetaChain supports applications that can centralize logic and state on its Layer 1, while LayerZero supplies messaging that connects application components deployed elsewhere.
Start with the architecture, then test the workflowThe right comparison is not which platform has the longest feature list. It is which execution model matches your application's state, user journey, and operational capacity. If a single coordinating application can simplify the product, build a Universal App proof of concept and test its hardest path.
Start Building with the ZetaChain documentation, then validate supported networks, contract patterns, and production requirements against your design.
PANews reported on June 25 that ZetaChain announced it will extend its AI privacy memory layer to staking scenarios. Starting today, users staking ZETA will not only continue to receive native staking rewards but also earn AI credits on Anuma. This benefit is calculated based on the value of staked ZETA, with no need to move, lock, or cross-chain tokens. Anuma will directly read the user's staking balance on ZetaChain. After connecting a wallet and signing to prove address ownership, users can start accumulating credits, which can be used for AI features on Anuma such as chat, image, audio, video, and agents, covering AI models like Claude, GPT, Gemini, and Grok. Additionally, staking 100,000 ZETA or more automatically unlocks Anuma Pro.
PANews reported on April 28th that, according to SlowMist's analysis, the root cause of the ZetaChain attack lies in the lack of access control and input validation in the GatewayZEVM contract's `call` function. This allows any user to initiate cross-chain calls through GatewayZEVM and execute arbitrary operations on external chains via relays. Attackers exploited this vulnerability to construct malicious cross-chain events on ZetaChain. After the relays captured these events, they executed malicious calls on the target chain via TSS, thereby stealing funds.
Previously, ZetaChain reported that its GatewayEVM contract had been attacked, but the attack route has been blocked and user funds are safe .
Author: PA一线
This content is for market information only and is not investment advice.
ZetaChain has paused cross-chain transactions on its mainnet after detecting an attack on its GatewayEVM contract.
Summary
ZetaChain paused cross-chain transactions after detecting an attack on its GatewayEVM smart contract. The team said only internal wallets were affected and no user funds were lost. DefiLlama reported $300,000 in losses as ZetaChain prepared a detailed post-mortem. The Layer 1 network said the move was a precaution while the team investigates the incident. GatewayEVM works as a key entry point for cross-chain activity between EVM-compatible networks and applications on ZetaChain. The contract helps route interactions across connected chains.
ZetaChain said the attack affected only internal team wallets. The team added that it had already closed the attack path to stop more funds from being compromised.
“As a precaution, cross-chain transactions are currently paused on ZetaChain,” the team said. “Investigation is still ongoing, and at this time no user funds were impacted by this attack.”
DefiLlama data shows the attack caused about $300,000 in losses. ZetaChain has not confirmed the exact amount and said it plans to publish a full post-mortem.
According to ZetaChain’s official status page, cross-chain transactions remained paused as of 9:00 p.m. ET on Monday. That was about nine hours after the team first identified the attack.
DeFi security concerns continue ZetaChain launched its mainnet in early 2024 and focuses on blockchain interoperability. The project describes itself as a universal blockchain that connects networks such as Bitcoin, Ethereum, and Polygon.
The attack comes after several recent DeFi security incidents. The LayerZero-powered Kelp DAO bridge exploit drained $292 million and created bad debt on Aave. Since that event, DefiLlama data shows at least 10 attacks on DeFi projects.
The interoperability-focused blockchain network ZetaChain has suffered a security exploit, resulting in the draining of funds directly from internal team wallets. Fortunately for the broader crypto community, developers were able to quickly patch the vulnerability before the attacker could compromise user assets.
The root cause According to the security experts at SlowMist, the core vulnerability was located within the call function of ZetaChain's GatewayZEVM contract. Crucially, this specific function lacked proper access control mechanisms and input validation parameters.
Because of these missing security checks, the system was left wide open for exploitation. The flaw allowed any arbitrary user to bypass normal restrictions, invoke cross-chain calls through the GatewayZEVM contract, and execute unauthorized operations on external blockchains.
HOT Stories
The modus operandi The attacker was able to craft a highly specific, malicious call directly on ZetaChain designed to emit a fraudulent cross-chain event.
ZetaChain's relayer, which is designed to listen for and facilitate these cross-chain communications, automatically picked up this event.
The relayer unknowingly executed the malicious call on the destination chain, allowing the attacker to effectively siphon the funds.
Damage contained ZetaChain has assured the community that the damage was strictly isolated to their own holdings.
"There was an attack against the ZetaChain GatewayEVM contract today that impacted the internal ZetaChain team wallets only," the protocol's developers stated. "We've already blocked the attack vector so no more funds can be compromised."
ZetaChain has temporarily paused cross-chain transactions after an attack targeted its GatewayEVM contract, marking the latest security incident involving blockchain interoperability infrastructure.
The layer-1 blockchain said the exploit affected internal team wallets only and that no user funds were compromised. Developers added that the attack vector had been contained, with no further losses expected, while a full post-mortem report will be released following the investigation.
As a precaution, cross-chain transfers across connected networks remain suspended while engineers complete remediation work and review system security.
Attack centered on GatewayEVM contract ZetaChain’s GatewayEVM contract serves as a core interface for cross-chain interactions between external EVM-compatible networks and applications deployed on ZetaChain. The contract enables token transfers and smart contract calls across multiple connected chains, making it a critical component of the protocol’s interoperability architecture.
Because gateway contracts coordinate assets and messaging between networks, they are often considered high-value targets for attackers. Security researchers have repeatedly identified bridges and interoperability layers as among the most vulnerable areas of decentralized finance.
Early third-party analysis suggested the exploit may have involved weaknesses in contract controls or input validation, though ZetaChain has not yet confirmed a formal technical cause.
The protocol has not publicly disclosed the exact financial impact. External estimates have circulated, but no verified figure has been released by the development team.
Cross-chain sector remains under scrutiny The incident adds to a growing list of exploits involving cross-chain systems, a category that has historically accounted for some of the largest losses in the crypto market. Previous attacks on bridge infrastructure have exposed structural vulnerabilities across the sector.
These systems often manage large pools of collateral or depend on complex validator and messaging frameworks, creating multiple attack surfaces. Security failures in such architecture can trigger not only direct losses but also broader confidence concerns across connected ecosystems.
ZetaChain launched its mainnet as a universal blockchain designed to connect networks such as Bitcoin, Ethereum, and other ecosystems through native interoperability. The project has attracted attention for seeking to simplify cross-chain application development and asset movement.
The temporary suspension of cross-chain functionality is likely to disrupt user activity, liquidity routing, and application flows built on the network until services are restored. Protocol teams often halt bridge functions during incidents to prevent secondary losses or exploitation of related components.
For users and investors, the immediate focus will be the forthcoming post-mortem report, which is expected to clarify how the exploit occurred, the scope of affected assets, and what security upgrades will be implemented before reopening transfers.
The event reinforces a broader trend in digital assets: as blockchain ecosystems compete on interoperability, security standards are becoming as important as transaction speed and cost.
While ZetaChain said user funds were unaffected, the incident underscores that even newer architectures remain exposed to smart contract risk. Confidence in cross-chain platforms increasingly depends not only on growth metrics, but also on their ability to respond quickly and transparently when vulnerabilities emerge.
PANews reported on April 29th that ZetaChain released an update on its X platform stating that on April 27th, ZetaChain suffered a premeditated targeted attack . The attackers used Tornado Cash to deposit funds and forged wallet addresses. Cross-chain ZETA transfers were unaffected, user funds were unaffected, and all affected wallets were under ZetaChain control. A mainnet patch has been deployed, and cross-chain transactions will be re-enabled after continuous monitoring. This attack impacted certain arbitrary call functions of GatewayEVM, resulting in a loss of approximately $334,000 across four connected chains.
Rubio: US and Iran to continue technical consultations at the end of this month
Multiple foreign media outlets reported on the 24th that US Secretary of State Rubio said technical teams from the United States and Iran will hold further talks in Switzerland by the end of June. (Xinhua News Agency)
5 hours ago
Over the past 24 hours, total crypto market liquidations hit $606 million, with more than 130,000 traders liquidated.
According to Coinglass data, the global cryptocurrency market recorded $606 million in liquidations over the past 24 hours, including $542 million in long-position liquidations and $68.22 million in short-position liquidations. A total of 135,785 traders worldwide were liquidated in the same period, with the largest single liquidation order occurring on Binance’s BTCUSDT trading pair, valued at $12.0111 million.
5 hours ago
Bitcoin falls below $60,000
According to HTX market data, Bitcoin has fallen below $60,000, with a 4.3% drop in the past 24 hours.
5 hours ago
US Treasury Secretary: AI boom may boost productivity and help curb inflation.
US Treasury Secretary Bessent told CNBC in an interview that he hopes the Federal Reserve will remain "open-minded" about the inflation pattern after the reversal of Iran-related energy price hikes. Bessent noted that the U.S. could enter an economic environment marked by high GDP growth without a corresponding rise in traditional inflation. He cited that in the 1990s, Alan Greenspan foresaw that office modernization and the internet could drive non-inflationary growth, and allowed the economy to keep expanding. Bessent believes the U.S. has a strong chance of seeing a similar scenario again. When asked whether the Fed still needs to worry about potential inflation and whether interest rate cuts are possible this year or next, Bessent declined to comment. However, he argued that it is necessary to stay open-minded about the price or inflation impacts from the Iran conflict, and monitor inflation performance after those effects subside. Bessent also said an open mind is needed, as the AI boom could boost productivity and deliver disinflationary effects, helping inflation return to the Fed’s target level. He added that he believes Kevin Warsh will choose the optimal path that meets both the Fed’s inflation and growth mandates. Bessent also noted that Warsh previously took a hawkish stance on inflation.
5 hours ago
US stocks' intraday storage sector sees broad declines, with Western Digital and Seagate Technology both falling over 4%.
According to Bitget data, during U.S. stock trading hours, the storage sector saw broad declines: Western Digital (WDC) fell 4.47%, Seagate Technology (STX) dropped 4.17%, SanDisk (SNDK) declined 2.31%, and Micron Technology (MU) edged down 0.96%. Most optical communication concept stocks rose, with Corning (GLW) leading the gains at 9.75%, followed by Ciena (CIEN) up 3.24%, Coherent (COHR) rising 2.93%, Lumentum (LITE) gaining 2.61%, and Nokia (NOK) advancing 1.82%. Additionally, Marvell Technology (MRVL) fell 2.59% and Applied Optoelectronics (AAOI) declined 1.90%.
5 hours ago
During intraday trading in U.S. stocks, crypto-related concept stocks fell broadly, with MSTR dropping more than 7%.
According to Bitget market data, the three major U.S. stock indexes rose broadly: the Dow Jones Industrial Average gained 0.94%, the S&P 500 increased 0.60%, and the Nasdaq rose 0.63%. Crypto-related stocks fell across the board, with declines as follows: Strategy (MSTR) down 7.33%; Circle (CRCL) down 4.35%; Bitmine (BMNR) down 3.97%; Coinbase (COIN) down 3.73%; Robinhood (HOOD) down 3.70%; Gemini (GEMI) down 3.27%; Bullish (BLSH) down 3.25%; Sharplink (SBET) down 3.19%.
Rubio: US and Iran to continue technical consultations at the end of this month
Multiple foreign media outlets reported on the 24th that US Secretary of State Rubio said technical teams from the United States and Iran will hold further talks in Switzerland by the end of June. (Xinhua News Agency)
5 hours ago
Over the past 24 hours, total crypto market liquidations hit $606 million, with more than 130,000 traders liquidated.
According to Coinglass data, the global cryptocurrency market recorded $606 million in liquidations over the past 24 hours, including $542 million in long-position liquidations and $68.22 million in short-position liquidations. A total of 135,785 traders worldwide were liquidated in the same period, with the largest single liquidation order occurring on Binance’s BTCUSDT trading pair, valued at $12.0111 million.
5 hours ago
Bitcoin falls below $60,000
According to HTX market data, Bitcoin has fallen below $60,000, with a 4.3% drop in the past 24 hours.
5 hours ago
US Treasury Secretary: AI boom may boost productivity and help curb inflation.
US Treasury Secretary Bessent told CNBC in an interview that he hopes the Federal Reserve will remain "open-minded" about the inflation pattern after the reversal of Iran-related energy price hikes. Bessent noted that the U.S. could enter an economic environment marked by high GDP growth without a corresponding rise in traditional inflation. He cited that in the 1990s, Alan Greenspan foresaw that office modernization and the internet could drive non-inflationary growth, and allowed the economy to keep expanding. Bessent believes the U.S. has a strong chance of seeing a similar scenario again. When asked whether the Fed still needs to worry about potential inflation and whether interest rate cuts are possible this year or next, Bessent declined to comment. However, he argued that it is necessary to stay open-minded about the price or inflation impacts from the Iran conflict, and monitor inflation performance after those effects subside. Bessent also said an open mind is needed, as the AI boom could boost productivity and deliver disinflationary effects, helping inflation return to the Fed’s target level. He added that he believes Kevin Warsh will choose the optimal path that meets both the Fed’s inflation and growth mandates. Bessent also noted that Warsh previously took a hawkish stance on inflation.
5 hours ago
US stocks' intraday storage sector sees broad declines, with Western Digital and Seagate Technology both falling over 4%.
According to Bitget data, during U.S. stock trading hours, the storage sector saw broad declines: Western Digital (WDC) fell 4.47%, Seagate Technology (STX) dropped 4.17%, SanDisk (SNDK) declined 2.31%, and Micron Technology (MU) edged down 0.96%. Most optical communication concept stocks rose, with Corning (GLW) leading the gains at 9.75%, followed by Ciena (CIEN) up 3.24%, Coherent (COHR) rising 2.93%, Lumentum (LITE) gaining 2.61%, and Nokia (NOK) advancing 1.82%. Additionally, Marvell Technology (MRVL) fell 2.59% and Applied Optoelectronics (AAOI) declined 1.90%.
5 hours ago
During intraday trading in U.S. stocks, crypto-related concept stocks fell broadly, with MSTR dropping more than 7%.
According to Bitget market data, the three major U.S. stock indexes rose broadly: the Dow Jones Industrial Average gained 0.94%, the S&P 500 increased 0.60%, and the Nasdaq rose 0.63%. Crypto-related stocks fell across the board, with declines as follows: Strategy (MSTR) down 7.33%; Circle (CRCL) down 4.35%; Bitmine (BMNR) down 3.97%; Coinbase (COIN) down 3.73%; Robinhood (HOOD) down 3.70%; Gemini (GEMI) down 3.27%; Bullish (BLSH) down 3.25%; Sharplink (SBET) down 3.19%.
TLDR: ZetaChain’s GatewayEVM arbitrary call flaw allowed attackers to drain $333,868 across four blockchains. All three wallets drained were ZetaChain-controlled; no external user funds were lost in the exploit. The attacker brute-forced a vanity address with 13 matching characters to execute an address poisoning attack. A bug bounty report flagging this vulnerability was previously dismissed as intended protocol behavior by ZetaChain. ZetaChain confirmed a targeted exploit on April 26, 2026, resulting in losses of approximately $333,868. The attack targeted the protocol’s GatewayEVM contract through a deliberate chain of design weaknesses.
No external user funds were lost in the incident. All three affected wallets were under ZetaChain’s control. A patch has since been deployed, and cross-chain transactions remain paused pending full operator upgrades.
How the Attacker Exploited the Gateway Contract The exploit centered on the arbitrary call functionality within ZetaChain’s GatewayEVM contract. An attacker used the isArbitraryCall flag to bypass normal sender verification in cross-chain messages.
This caused ZetaClient software to zero out the sender address, routing calls through _executeArbitraryCall(). That function performed raw external calls with minimal restrictions.
The function’s only protection was a deny-list blocking onCall and onRevert selectors. Critical ERC-20 functions like transferFrom and approve were left unblocked.
The attacker set the destination as an ERC-20 token contract and passed transferFrom as the calldata. Since the gateway held pre-existing allowances from victim wallets, it executed the transfer successfully.
Nine drain transactions occurred across four chains — Ethereum, Base, Arbitrum, and BSC. The largest single drain was $110,291 in USDC on Base.
A comprehensive Dune Analytics scan confirmed no additional victims existed across all five connected EVM chains.
ZetaChain addressed the incident directly on X, stating that “cross-chain ZETA transfers were not affected” and that “no user funds were affected — all impacted wallets were ZetaChain-controlled.”
On Apr 27, ZetaChain experienced a targeted exploit involving deliberate preparation, including Tornado Cash funding and wallet address spoofing.
Cross-chain ZETA transfers were not affected.
No user funds were affected — all impacted wallets were ZetaChain-controlled.
A…
— ZetaChain 🟩 (@ZetaChain) April 29, 2026
The Attacker’s Preparation Was Methodical and Deliberate This was not an opportunistic attack. The hacker funded the primary wallet through Tornado Cash approximately three days before executing the exploit. That deliberate step obscured the origin of funds ahead of the operation.
The attacker also brute-forced a vanity wallet address that closely resembled a victim’s real address. The fake address shared 13 matching hexadecimal characters with the real one — four at the prefix and nine at the suffix.
Generating this required an estimated 4.5 quadrillion trial keys, costing between $300 and $2,500 in GPU compute.
That fake address was used to send dust transactions to the victim, planting a lookalike in their transaction history.
This technique exploits how wallet interfaces truncate addresses for display. A purpose-built drainer contract was also deployed on ZetaChain to orchestrate the cross-chain calls.
Every single drain succeeded with zero destination failures. The post-mortem noted this pattern, suggesting “the hacker had carefully pre-validated each target’s allowance state and token balances before executing.”
ZetaChain’s Response and User Recommendations ZetaChain paused all cross-chain transactions within eight minutes of detecting the attack. The team removed infinite allowance approvals from the ZetaHub deposit flow the same day. New deposits now approve only exact amounts required per transaction.
A zetaclient patch was developed, tested on Testnet, and is now rolling out to mainnet operator nodes. The patch permanently disables the arbitrary call code path that made this exploit possible. Validator node operators do not need to take action — only observer nodes require the upgrade.
All identified exploiter addresses were flagged through the SEAL 911 emergency response network. A report was also filed with law enforcement through IC3.gov. Stolen funds on Ethereum were swapped to approximately 139 ETH and moved to a consolidation wallet.
ZetaChain is also reviewing its bug bounty triage process. The post-mortem acknowledged that the vulnerability had been flagged earlier, noting that “initial reports were dismissed as the arbitrary call behavior was considered by-design.”
The protocol added that the incident has since prompted a review of triage procedures for chained attack vectors. Users with prior gateway interactions are advised to revoke ERC-20 allowances using tools like Revoke.cash.
The vulnerability that led to ZetaChain’s recent exploit had been flagged through its bug bounty program before the attack, but was dismissed as intended behavior.
In a post-mortem published Wednesday, the team said the incident has prompted a review of how it handles bug bounty submissions, particularly reports involving chained attack vectors that may appear harmless in isolation but are dangerous in combination.
“This bug was reported and they simply ignored it,” one user wrote on X. “That's how bug bounty programs work with these protocols currently; they incentivize losses for the protocol, the TVL, and the user's balance instead of paying the researcher for discovering and fixing the bug,” they added.
ZetaChain lost approximately $334,000 to a premeditated exploit on Sunday that targeted its cross-chain gateway contract. The exploit drained funds across nine transactions on four chains, including Ethereum, Arbitrum, Base and BSC, all from ZetaChain-controlled wallets. No user funds were affected.
Attacker exploits small design flawsZetaChain said in its post-mortem that the attacker exploited three design flaws that, individually, might have seemed minor, but together opened the door to a full drain. First, the gateway allowed anyone to send arbitrary cross-chain instructions with no restrictions. Second, on the receiving end, it would execute almost any command on any contract, with a blocklist so narrow it missed basic token transfer functions.
Third, wallets that had previously used the gateway had left unlimited spending permissions in place that were never cleaned up. By combining all three, the attacker simply told the gateway to transfer tokens from victim wallets to their own, and the gateway complied.
Source: ZetaChain
“This was not an opportunistic attack,” ZetaChain said in its post-mortem. The attacker funded their wallet through Tornado Cash three days before the exploit, deployed a purpose-built drainer contract on ZetaChain and ran an address poisoning campaign before seeding it into their transaction history via dust transfers.
ZetaChain added that a patch permanently disabling the arbitrary call functionality is being rolled out to mainnet nodes. The platform also removed unlimited token approvals from its deposit flow, replacing them with exact-amount approvals going forward.
AI DeFi exploit success rate increasesA new study by a16z tested whether an off-the-shelf AI agent could go beyond identifying DeFi vulnerabilities and actually produce working exploits. Using OpenAI's Codex against a dataset of 20 real Ethereum price manipulation incidents, researchers ran the agent in a sandboxed environment with no access to future transaction data and no guidance on how the attacks worked. The agent succeeded in just 10% of cases.
However, when researchers fed the agent structured knowledge about common attack patterns and exploit workflows, the success rate jumped to 70%.
Magazine: How to fix suspected insider trading on Polymarket and Kalshi
Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.
Rubio: US and Iran to continue technical consultations at the end of this month
Multiple foreign media outlets reported on the 24th that US Secretary of State Rubio said technical teams from the United States and Iran will hold further talks in Switzerland by the end of June. (Xinhua News Agency)
5 hours ago
Over the past 24 hours, total crypto market liquidations hit $606 million, with more than 130,000 traders liquidated.
According to Coinglass data, the global cryptocurrency market recorded $606 million in liquidations over the past 24 hours, including $542 million in long-position liquidations and $68.22 million in short-position liquidations. A total of 135,785 traders worldwide were liquidated in the same period, with the largest single liquidation order occurring on Binance’s BTCUSDT trading pair, valued at $12.0111 million.
5 hours ago
Bitcoin falls below $60,000
According to HTX market data, Bitcoin has fallen below $60,000, with a 4.3% drop in the past 24 hours.
5 hours ago
US Treasury Secretary: AI boom may boost productivity and help curb inflation.
US Treasury Secretary Bessent told CNBC in an interview that he hopes the Federal Reserve will remain "open-minded" about the inflation pattern after the reversal of Iran-related energy price hikes. Bessent noted that the U.S. could enter an economic environment marked by high GDP growth without a corresponding rise in traditional inflation. He cited that in the 1990s, Alan Greenspan foresaw that office modernization and the internet could drive non-inflationary growth, and allowed the economy to keep expanding. Bessent believes the U.S. has a strong chance of seeing a similar scenario again. When asked whether the Fed still needs to worry about potential inflation and whether interest rate cuts are possible this year or next, Bessent declined to comment. However, he argued that it is necessary to stay open-minded about the price or inflation impacts from the Iran conflict, and monitor inflation performance after those effects subside. Bessent also said an open mind is needed, as the AI boom could boost productivity and deliver disinflationary effects, helping inflation return to the Fed’s target level. He added that he believes Kevin Warsh will choose the optimal path that meets both the Fed’s inflation and growth mandates. Bessent also noted that Warsh previously took a hawkish stance on inflation.
5 hours ago
US stocks' intraday storage sector sees broad declines, with Western Digital and Seagate Technology both falling over 4%.
According to Bitget data, during U.S. stock trading hours, the storage sector saw broad declines: Western Digital (WDC) fell 4.47%, Seagate Technology (STX) dropped 4.17%, SanDisk (SNDK) declined 2.31%, and Micron Technology (MU) edged down 0.96%. Most optical communication concept stocks rose, with Corning (GLW) leading the gains at 9.75%, followed by Ciena (CIEN) up 3.24%, Coherent (COHR) rising 2.93%, Lumentum (LITE) gaining 2.61%, and Nokia (NOK) advancing 1.82%. Additionally, Marvell Technology (MRVL) fell 2.59% and Applied Optoelectronics (AAOI) declined 1.90%.
5 hours ago
During intraday trading in U.S. stocks, crypto-related concept stocks fell broadly, with MSTR dropping more than 7%.
According to Bitget market data, the three major U.S. stock indexes rose broadly: the Dow Jones Industrial Average gained 0.94%, the S&P 500 increased 0.60%, and the Nasdaq rose 0.63%. Crypto-related stocks fell across the board, with declines as follows: Strategy (MSTR) down 7.33%; Circle (CRCL) down 4.35%; Bitmine (BMNR) down 3.97%; Coinbase (COIN) down 3.73%; Robinhood (HOOD) down 3.70%; Gemini (GEMI) down 3.27%; Bullish (BLSH) down 3.25%; Sharplink (SBET) down 3.19%.
ZetaChain has acknowledged that a vulnerability behind its recent exploit had already been reported through its bug bounty program, but was treated as expected behavior.
According to ZetaChain’s post-mortem published Wednesday, the incident has triggered an internal review of how the protocol evaluates bug bounty submissions, especially those involving multi-step attack paths that may appear harmless when viewed separately.
The disclosure follows an attack on Sunday that targeted the project’s cross-chain gateway contract, draining about $334,000 across nine transactions on Ethereum, Arbitrum, Base, and BSC, all from wallets controlled by the team.
ZetaChain stated that no user funds were impacted, a point it had also emphasized a day earlier when it paused cross-chain transactions on its mainnet to contain the breach.
DefiLlama data had earlier estimated the losses at roughly $300,000, while ZetaChain said at the time that it would release a full breakdown after completing its investigation.
Flaws combined to enable full drain ZetaChain said the attacker chained together three separate design weaknesses that, on their own, did not appear critical but together enabled the exploit. The gateway contract allowed unrestricted cross-chain instructions to be sent, while the receiving side executed nearly any command on any contract, with a limited blocklist that failed to cover basic token transfer functions.
Existing wallets that had interacted with the gateway retained unlimited token approvals, which were not revoked. By combining these conditions, the attacker instructed the gateway to move tokens from those wallets, and the system executed the transfers without resistance.
“This was not an opportunistic attack,” ZetaChain said, outlining how the attacker prepared in advance by funding a wallet through Tornado Cash three days before the exploit, deploying a custom drainer contract on ZetaChain, and running an address poisoning campaign before initiating the transactions.
Bug report dismissed before exploit In its post-mortem, ZetaChain confirmed that the core issue had been raised earlier through its bug bounty program but was not treated as a threat at the time. The team said this has prompted a reassessment of how it handles reports that describe complex attack combinations rather than isolated bugs.
“This bug was reported and they simply ignored it,” one user wrote on X, adding that current bug bounty structures often fail to reward researchers for identifying vulnerabilities before they are exploited.
Following the incident, ZetaChain said it has disabled the gateway’s arbitrary call functionality through a patch being rolled out to mainnet nodes. The platform has also removed unlimited token approvals from its deposit process, replacing them with exact-amount approvals to reduce risk from similar attack patterns.
The vulnerability that led to ZetaChain’s recent exploit had been flagged through its bug bounty program before the attack, but was dismissed as intended behavior.
In a post-mortem published Wednesday, the team said the incident has prompted a review of how it handles bug bounty submissions, particularly reports involving chained attack vectors that may appear harmless in isolation but are dangerous in combination.
“This bug was reported and they simply ignored it,” one user wrote on X. “That's how bug bounty programs work with these protocols currently; they incentivize losses for the protocol, the TVL, and the user's balance instead of paying the researcher for discovering and fixing the bug,” they added.
ZetaChain lost approximately $334,000 to a premeditated exploit on Sunday that targeted its cross-chain gateway contract. The exploit drained funds across nine transactions on four chains, including Ethereum, Arbitrum, Base and BSC, all from ZetaChain-controlled wallets. No user funds were affected.
Attacker exploits small design flawsZetaChain said in its post-mortem that the attacker exploited three design flaws that, individually, might have seemed minor, but together opened the door to a full drain. First, the gateway allowed anyone to send arbitrary cross-chain instructions with no restrictions. Second, on the receiving end, it would execute almost any command on any contract, with a blocklist so narrow it missed basic token transfer functions.
Third, wallets that had previously used the gateway had left unlimited spending permissions in place that were never cleaned up. By combining all three, the attacker simply told the gateway to transfer tokens from victim wallets to their own, and the gateway complied.
Source: ZetaChain
“This was not an opportunistic attack,” ZetaChain said in its post-mortem. The attacker funded their wallet through Tornado Cash three days before the exploit, deployed a purpose-built drainer contract on ZetaChain and ran an address poisoning campaign before seeding it into their transaction history via dust transfers.
ZetaChain added that a patch permanently disabling the arbitrary call functionality is being rolled out to mainnet nodes. The platform also removed unlimited token approvals from its deposit flow, replacing them with exact-amount approvals going forward.
AI DeFi exploit success rate increasesA new study by a16z tested whether an off-the-shelf AI agent could go beyond identifying DeFi vulnerabilities and actually produce working exploits. Using OpenAI's Codex against a dataset of 20 real Ethereum price manipulation incidents, researchers ran the agent in a sandboxed environment with no access to future transaction data and no guidance on how the attacks worked. The agent succeeded in just 10% of cases.
However, when researchers fed the agent structured knowledge about common attack patterns and exploit workflows, the success rate jumped to 70%.
Magazine: How to fix suspected insider trading on Polymarket and Kalshi
Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.
Key TakeawaysCross-Chain Gateway Weakness Exploited Across Multiple NetworksPersistent Token Allowances Facilitated Fund DrainageEmergency Response and Industry-Wide Security Concerns Cross-chain protocol loses $334K through gateway contract vulnerability
Attack exploited unlimited token approvals and arbitrary function calls
Security breach affected internal team wallets across four blockchain networks
Platform implements emergency patch and pauses cross-chain operations
No user funds compromised during the security incident
A security breach on ZetaChain resulted in the theft of approximately $334,000 through vulnerabilities in its cross-chain gateway infrastructure. The attack specifically targeted internal team wallets using a sophisticated multi-chain approach. Platform operators responded by immediately suspending services and implementing security patches.
Cross-Chain Gateway Weakness Exploited Across Multiple Networks According to ZetaChain’s official statement, the security breach centered on the GatewayEVM contract, which manages cross-chain message passing and token transfers. Malicious actors exploited design flaws to execute unauthorized withdrawals. The theft spanned four blockchain networks: Ethereum, Arbitrum, Base, and BSC.
The platform disclosed that attackers leveraged multiple security gaps within the messaging infrastructure. The gateway system permitted unrestricted function calls between connected blockchains. This architectural weakness allowed remote activation of critical contract functions without proper safeguards.
Technical analysis revealed that the recipient contract processed diverse command types, including direct token movement operations. Insufficient validation mechanisms failed to prevent malicious instructions. Attackers capitalized on these loose restrictions to siphon funds from compromised addresses.
Persistent Token Allowances Facilitated Fund Drainage The exploit mechanism relied heavily on pre-existing unlimited token approvals granted to the gateway smart contract. These permissions had been established during earlier deposit transactions and never revoked. Attackers utilized transferFrom functions to extract ERC-20 tokens from wallets with active allowances.
Platform representatives emphasized that the security incident exclusively affected three wallets under team control. End-user deposits and holdings remained completely secure throughout the attack. The breach highlighted significant risks associated with permanent token permission grants.
Interestingly, security researchers had previously flagged this vulnerability through the platform’s bug bounty initiative. However, the submission was dismissed as intended functionality rather than a critical flaw. This classification error became a contributing factor when combined with other system weaknesses during the actual exploit.
Emergency Response and Industry-Wide Security Concerns Upon detecting the unauthorized transactions, ZetaChain immediately halted all cross-chain functionality. Engineers rapidly developed and deployed remediation code eliminating the arbitrary call feature. Services remain suspended pending comprehensive security audits and system enhancements.
The updated architecture replaces blanket token approvals with transaction-specific permission models. This modification significantly limits potential attack vectors in future operations. Platform administrators urged all users to revoke outstanding allowances associated with gateway infrastructure.
Investigation revealed sophisticated attack preparation by the perpetrators. Initial funding came through Tornado Cash privacy protocol, while address poisoning tactics created confusion. Stolen assets were immediately converted to ETH, complicating tracking efforts.
This incident adds to growing concerns about smart contract security across decentralized finance ecosystems. Industry data indicates increasing frequency of exploits targeting architectural vulnerabilities in recent months. ZetaChain announced comprehensive reviews of both bug bounty procedures and overall security protocols.
Oliver Dale
Editor-in-Chief of Blockonomi and founder of Kooc Media, A UK-Based Online Media Company. Believer in Open-Source Software, Blockchain Technology & a Free and Fair Internet for all. His writing has been quoted by Nasdaq, Dow Jones, Investopedia, The New Yorker, Forbes, Techcrunch & More. Contact [email protected]
The ZetaChain’s $334K exploit was preventable if the team had taken earlier bug reports seriously.
In the post-mortem report, the team admitted that the gateway vulnerability leveraged by the attacker had been disclosed in a bug bounty program, but they dismissed it.
Prior to the exploit, the vulnerability class had been reported through our bug bounty program. Initial reports were dismissed as the arbitrary call behavior was considered by design.
Going forward, the project added, it will review all bug bounty submissions to ensure “reports involving chained attack vectors receive appropriate severity assessment.”
That said, the project clarified that protocol-controlled wallets were the ones drained of $334K, adding that no user funds were lost.
April crypto hack losses top $600M In April, the losses from the rising crypto hacks hit $629 million, according to data tracked by DeFiLlama. This was the highest level of monthly losses so far in 2026.
In fact, even when zoomed out on a year-on-year (YoY) basis, it was still the largest loss.
Source: DeFiLlama This week alone, Aftermath Perps lost $1.14 million while Sweat Foundation suffered a $3.5M breach. ZetaChain, Judao, Scallop Lend, Syndicate, and Quant also suffered exploits ranging between $150K to $413K each.
Last week, Volo Vault, Purrlend, and Giddy also added to the growing list of victims. Perhaps the most notable victim in April is the Kelp DAO’s $293 million exploit, which triggered massive outflows across the DeFi ecosystem.
Yet, some of these exploits are preventable, especially with strong bug bounty programs. In the ZetaChain case, for example, there was a prior bug submission, which was ignored.
At the same time, the attacker did some tests before the exploit, which could be flagged by strong threat monitoring.
Now the industry will contend with another powerful threat actor: AI-powered models. Cybersecurity models with offensive capabilities like Anthropic’s Claude-powered Mythos and recently announced OpenAI’s GPT-5.5-Cyber are yet to be made public.
The reported offensive capability of these models should be a warning sign for the entire industry to take security measures more seriously or forget about mass adoption.
Final Summary ZetaChain admitted its $334K exploit was from a bug that was previously reported but wasn’t acted on. Losses linked to DeFi hacks in April have now crossed $600M, underscoring the need for proactive threat detection.
PANews reported on June 2nd that ZetaChain has fully transitioned from cross-chain infrastructure to AI, positioning itself as a "Private Memory Layer" for AI. The official statement indicated that after four years of building cross-chain infrastructure, the team's exploration of whether interoperability can extend from chains and assets to AI intelligence itself has been validated.
ZetaChain's AI product, Anuma, surpassed 60,000 users in its first month. It allows users to share the same set of context, preferences, and memories across multiple mainstream models, including ChatGPT, Gemini, Claude, DeepSeek, and Kimi, eliminating the need to repeatedly build background information when switching models. ZetaChain states that Anuma's core is "user-owned privacy AI." Users can log in directly through their wallets without needing personal information such as email or name; all memory content is encrypted on the user's device, rather than stored on the platform's servers.
In addition, ZetaChain announced a new incentive mechanism around ZETA. Users who lock ZETA can earn Anuma Tokens daily and redeem AI credits to use various AI models; users who lock 80,000 ZETA will automatically unlock Anuma Pro, which includes higher amounts of AI credits, all models, and full privacy features.
ZetaChain has previously focused on cross-chain interoperability infrastructure, and this time it has further proposed the concept of "AI Consumer Layer", which will attempt to build a new AI user layer around memory, identity, permissions, payment and agent collaboration.
Here’s a problem most people don’t think about until it’s annoying: every time you switch between AI tools, you start from scratch. Your ChatGPT conversation history means nothing to Claude. Your Gemini preferences don’t carry over anywhere.
ZetaChain thinks it has a fix. The blockchain network has launched Anuma, which it calls a “private memory layer for AI,” designed to let users store encrypted, portable context that works across multiple AI platforms. The product hit 100,000 users within 38 days of going public.
What Anuma actually does Think of Anuma as a personal vault for your AI interactions. Instead of each AI model maintaining its own siloed understanding of who you are and what you need, Anuma creates a unified memory layer that travels with you. Your preferences, conversation history, and contextual data get encrypted on your device and stored in a way that any compatible AI application can access, but only with your permission.
The encryption runs on AES-GCM. Your data gets scrambled before it ever leaves your device, and only you hold the keys to unscramble it. No centralized server, no AI company, and no blockchain validator can read your memory vault without your explicit consent.
Advertisement
The platform also includes a feature called Memory Import, which lets users bring existing context from other AI tools into the Anuma ecosystem. Programmable permissions give users granular control over which applications can access which parts of their stored memory.
ZetaChain’s ZETA token handles access fees, usage settlements, and creator rewards within the ecosystem.
From cross-chain bridges to AI infrastructure The network originally built its reputation on cross-chain interoperability, connecting different blockchains so assets and data could move between them. That infrastructure attracted a historical user base of 12 million with over 240 million transactions processed.
ZetaChain 2.0 and the Anuma beta launched on January 27, 2026. By June 1, 2026, ZetaChain made the transition official, announcing it would focus exclusively on AI memory infrastructure.
Anuma reached 60,000 users in its first month after launch, then crossed the 100,000 threshold just 38 days after going public.
Why this matters for the AI subscription economy Only about 9% of users currently pay for multiple AI subscriptions. Each subscription exists in isolation, which means users are essentially paying multiple times to teach multiple AIs the same things about themselves.
Right now, when you use ChatGPT, OpenAI stores your conversations. When you use Claude, Anthropic does the same. Your AI interactions are scattered across multiple corporate servers, each governed by different privacy policies. Anuma’s client-side encryption model keeps the user in control of the data layer.
Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.
