[Security Disclosure] A potential weakness was reported related to the ZKsync wstETH bridge endpoint contract. As of yet, there is no indication that the weakness was exploited, and wstETH holders on ZKsync are not affected. No other bridges are affected. Out of an abundance of…
— Lido (@LidoFinance) March 3, 2026
Developers clarified that there are no indications that this weakness has been exploited by malicious actors so far. Therefore, current wstETH holders on the Layer 2 network are not affected, and transfer and withdrawal functions continue to operate normally.
The incident was managed through an emergency “multisig” mechanism, which allows for the immediate deactivation of critical functions. However, the pause will remain active for several weeks while a technical solution is prepared that meets the security standards required by the protocol.
Governance and Timelines for Resolving the Technical Flaw
Due to the platform’s decentralized structure, the implementation of the security patch cannot be immediate, as it requires a DAO vote. Consequently, the solution is expected to be deployed during the next vote scheduled for late March or early April 2026.
This announcement generated uncertainty in the markets, causing the prices of LDO and ZK tokens to fall over the last 24 hours. However, analysts suggest the reaction is preemptive and highlights the importance of auditing processes within decentralized finance (DeFi).
In summary, the early detection of the vulnerability in the Lido Finance bridge on ZKsync demonstrates the effectiveness of the network’s monitoring systems. Once the fix is audited and approved by governance, the deposit service will resume, consolidating a more resilient financial infrastructure against future potential threats.
crypto-economy.com
