On March 4th, it was reported that the Ethereum liquidity staking protocol Lido Finance recently announced that it has suspended new bridging deposits due to a potential security vulnerability found in the wstETH bridge contract endpoint on its ZKsync network. Lido stated in a notice that there are no signs of the vulnerability being exploited so far, and assets held by wstETH holders on ZKsync remain unaffected. Withdrawal and token transfer functions are still operating normally. This suspension is a precautionary measure aimed at reducing potential risks.
The issue involves the wstETH bridge contract endpoint on the ZKsync network. This smart contract is responsible for transferring staked ETH between the Ethereum mainnet and the ZKsync Layer 2 network. Although Lido has not disclosed specific technical details of the vulnerability, it has activated an emergency multi-signature mechanism to temporarily restrict bridging deposits to prevent potential attack vectors.
ZKsync is the fifth Layer 2 integration deployed by Lido. The bridging solution was developed jointly by Lido, Matter Labs, and txSync, with the goal of establishing a standardized cross-chain wstETH bridge contract. The wstETH bridging feature on ZKsync was launched in January 2024, following approval through governance voting by Lido DAO.
Lido stated that a fix for the vulnerability has been developed, but due to the protocol’s decentralized governance model, the patch must be reviewed and deployed through the next on-chain governance proposal. The current schedule estimates that the governance vote will take place from late March to early April 2026. Until the fix is officially implemented, the new bridging deposit function will remain suspended.
For DeFi users, this process reflects the security mechanism of decentralized governance and also indicates that the repair progress depends on on-chain voting coordination. Historical experience shows that upgrading or fixing vulnerabilities in DeFi protocols often takes a considerable amount of time to complete the community governance process.
In the market, related tokens have experienced short-term pressure. Lido’s governance token LDO dropped over 3.5% in the past 24 hours, trading around $0.305; meanwhile, ZKsync’s native token ZK also declined more than 3.1%, trading near $0.018. However, analysts note that both tokens were already in a downward trend before the announcement, and the security incident has further intensified market caution.
It is worth noting that Lido currently controls about one-third of the staked ETH on the Ethereum network, making it the largest single staking service provider. Therefore, even potential security risks could have spillover effects on the entire Ethereum staking ecosystem. Currently, Lido has confirmed that the withdrawal function for wstETH on ZKsync remains operational and user assets are not directly threatened.
Related Articles
X Product Chief Hints at Crypto Feature Launch as Platform Cleans Up Bot Activity
Gate Daily Report (April 14): The SEC releases regulatory guidance on self-custody wallet exemptions; Ondo submits a five-action letter regarding OGM tokenized equities
Today’s top 100 cryptocurrencies by market cap—price movers: RAVE up 207.51%, DOT down 4.57%
Crypto Market Momentum – Analyzing Today’s Top Gainers and the Shift in Investor Sentiment
Gate contract stock section will launch on April 13 with the first 5 Hong Kong stock perpetual contracts, including Tencent, Xiaomi, Meituan, and others, supporting 1x–20x leveraged trading
Gate Daily Report (April 13): The CFTC seeks “exclusive regulatory authority” for prediction markets; the FBI report says crypto fraud losses totaled 113.6 billion.