The final fix will be audited and implemented via a governance vote in late March.
Ethereum’s largest liquid staking protocol identified a vulnerability in the Lido Finance bridge on ZKsync and immediately took emergency measures. In an official statement, the team reported that new deposits into the wstETH endpoint contract have been suspended as a precautionary step to protect the ecosystem.
Developers clarified that there are no indications that this weakness has been exploited by malicious actors so far. Therefore, current wstETH holders on the Layer 2 network are not affected, and transfer and withdrawal functions continue to operate normally.
The incident was managed through an emergency “multisig” mechanism, which allows for the immediate deactivation of critical functions. However, the pause will remain active for several weeks while a technical solution is prepared that meets the security standards required by the protocol.
Due to the platform’s decentralized structure, the implementation of the security patch cannot be immediate, as it requires a DAO vote. Consequently, the solution is expected to be deployed during the next vote scheduled for late March or early April 2026.
This announcement generated uncertainty in the markets, causing the prices of LDO and ZK tokens to fall over the last 24 hours. However, analysts suggest the reaction is preemptive and highlights the importance of auditing processes within decentralized finance (DeFi).
