Lido suspends ZKsync bridge deposits, raising security concerns; LDO and ZK both weaken

On March 4th, it was reported that the Ethereum liquidity staking protocol Lido Finance recently announced that it has suspended new bridging deposits due to a potential security vulnerability found in the wstETH bridge contract endpoint on its ZKsync network. Lido stated in a notice that there are no signs of the vulnerability being exploited so far, and assets held by wstETH holders on ZKsync remain unaffected. Withdrawal and token transfer functions are still operating normally. This suspension is a precautionary measure aimed at reducing potential risks.

The issue involves the wstETH bridge contract endpoint on the ZKsync network. This smart contract is responsible for transferring staked ETH between the Ethereum mainnet and the ZKsync Layer 2 network. Although Lido has not disclosed specific technical details of the vulnerability, it has activated an emergency multi-signature mechanism to temporarily restrict bridging deposits to prevent potential attack vectors.

ZKsync is the fifth Layer 2 integration deployed by Lido. The bridging solution was developed jointly by Lido, Matter Labs, and txSync, with the goal of establishing a standardized cross-chain wstETH bridge contract. The wstETH bridging feature on ZKsync was launched in January 2024, following approval through governance voting by Lido DAO.

Lido stated that a fix for the vulnerability has been developed, but due to the protocol’s decentralized governance model, the patch must be reviewed and deployed through the next on-chain governance proposal. The current schedule estimates that the governance vote will take place from late March to early April 2026. Until the fix is officially implemented, the new bridging deposit function will remain suspended.

For DeFi users, this process reflects the security mechanism of decentralized governance and also indicates that the repair progress depends on on-chain voting coordination. Historical experience shows that upgrading or fixing vulnerabilities in DeFi protocols often takes a considerable amount of time to complete the community governance process.

In the market, related tokens have experienced short-term pressure. Lido’s governance token LDO dropped over 3.5% in the past 24 hours, trading around $0.305; meanwhile, ZKsync’s native token ZK also declined more than 3.1%, trading near $0.018. However, analysts note that both tokens were already in a downward trend before the announcement, and the security incident has further intensified market caution.

It is worth noting that Lido currently controls about one-third of the staked ETH on the Ethereum network, making it the largest single staking service provider. Therefore, even potential security risks could have spillover effects on the entire Ethereum staking ecosystem. Currently, Lido has confirmed that the withdrawal function for wstETH on ZKsync remains operational and user assets are not directly threatened.