The LayerZero messaging ecosystem experienced a fresh security breach on February 7, 2026, as the LZMultiCall protocol fell victim to an arbitrary call vulnerability that siphoned approximately $142,000 in losses on the Ethereum network. The incident adds to a turbulent week for decentralized finance, with six separate attacks totaling roughly $3.8 million in losses between February 2 and February 8, according to blockchain security firm BlockSec.
The Exploit Mechanics
The LZMultiCall vulnerability centered on an arbitrary call flaw that allowed an attacker to manipulate the protocol’s execution flow. In essence, the contract failed to properly validate and sanitize the targets and calldata being passed through its multi-call execution path. This meant that an external caller could craft a malicious payload instructing the contract to invoke arbitrary functions on any external address — a classic arbitrary external call vulnerability.
The attacker constructed a transaction that directed the LZMultiCall contract to call an external router with carefully crafted calldata, effectively bypassing intended access controls. Because the contract did not enforce strict validation on the destination addresses or the function signatures being called, the exploit payload executed without triggering any internal safety checks. The result was a direct drainage of funds from the protocol’s liquidity pools to the attacker’s controlled address.
BlockSec noted that the incident was not caused by a flash loan attack or price manipulation. Instead, the root cause was purely a smart contract logic error — the protocol exposed a function path that should have been restricted to trusted callers or, at minimum, required validation of the calldata being forwarded.
Affected Systems
The attack was isolated to the LZMultiCall deployment on Ethereum. LayerZero’s core messaging protocol, which powers cross-chain communication for dozens of decentralized applications, was not directly compromised. However, the incident underscores the cascading risk inherent in composable DeFi infrastructure: a vulnerability in one auxiliary contract can expose user funds even when the underlying protocol remains secure.
The timing is notable. The LZMultiCall exploit occurred on the same day that South Korean exchange Bithumb accidentally distributed 620,000 Bitcoin — worth approximately $44 billion — to users during a promotional event. While the Bithumb incident was an operational error rather than a security breach, the convergence of events highlights a broader theme: whether through code vulnerabilities or human error, the crypto ecosystem continues to face significant reliability challenges. Bitcoin traded at approximately $69,282 and Ethereum at $2,091 on this date, according to CoinMarketCap data.
The Mitigation Strategy
In response to the LZMultiCall exploit, security researchers have recommended several immediate and long-term mitigation strategies for protocols implementing multi-call or batch execution patterns:
1. Calldata Validation: All user-supplied calldata must be validated against a whitelist of permitted function selectors and target addresses before execution. Blanket forwarding of arbitrary calldata to external routers is a known anti-pattern that has been exploited repeatedly in DeFi.
2. Access Control on Execution Paths: Functions that execute external calls should be restricted to trusted addresses — typically protocol-owned contracts or governance-approved executors. Making such paths permissionless invites exactly the type of attack seen here.
3. Circuit Breaker Mechanisms: Protocols should implement transaction-level limits on the value that can be moved in a single call, along with time-locked withdrawal mechanisms that give teams a window to detect and respond to anomalous outflows.
Lessons Learned
The LZMultiCall incident reinforces a critical lesson that the DeFi community has learned repeatedly: multi-call and batch execution patterns are inherently dangerous when combined with insufficient input validation. The pattern — accepting user-supplied calldata and forwarding it to external contracts — has been at the center of numerous high-profile exploits, from the Poly Network breach to the GYD Protocol incident just days earlier on February 3, which lost approximately $700,000 to a similar vulnerability.
For developers building cross-chain messaging infrastructure, the takeaway is clear: every external call path must be treated as a potential attack surface. Defense-in-depth — combining access control, input validation, and runtime monitoring — is not optional. It is the minimum standard for any protocol handling user funds.
User Action Required
Users who interacted with the LZMultiCall protocol on Ethereum should immediately revoke any outstanding token approvals granted to the compromised contract. This can be done through tools like Revoke.cash or Etherscan’s token approval checker. Additionally, users should monitor their wallets for any unauthorized transactions originating from contracts in the LayerZero ecosystem, as secondary exploits sometimes follow initial breaches. If you hold positions in any LayerZero-connected protocols, verify that the teams have confirmed their contracts are not affected by this specific vulnerability before resuming normal activity.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before engaging with any cryptocurrency protocol.
$142K loss on an arbitrary call bug. embarassing for any protocol, but on LayerZero infrastructure it’s genuinely alarming. this pattern keeps repeating
LayerZero ecosystem keeps getting hit. the multi-call pattern needs better sanitization, this is like the third exploit using calldata manipulation
classic arbitrary external call. contract didnt validate targets before executing. literally security 101 stuff
0xScope.eth spot on. the multi-call pattern without target validation is security 101. LayerZero integrations keep copy-pasting the same flawed template
BlockSec reporting 6 attacks at 3.8M total that week and people still ape into any protocol with a UI
third time with calldata manipulation and still no standard sanitization layer. at some point this is a design choice not a bug
0xSieve.eth three times and counting. LayerZero keeps shipping integrations without pausing to fix the underlying pattern. the $142k is a warning shot not the ceiling
three LayerZero exploits using the same arbitrary call pattern and still no standardized sanitization layer. the 142k is a warning shot, next one will be 8 figures
0xSieve.eth fourth time if you count the Nomad bridge copy paste incident. same root cause each time. LayerZero needs to ship a reference implementation that blocks arbitrary calls by default
Six attacks totaling $3.8 million in one week. BlockSec must be working overtime. The frequency is whats alarming.
one attack is an incident, six in a week is a systemic problem with how defi contracts are being audited
six attacks in a week and only $3.8m total? honestly expected worse given the market conditions
dollar amount is low but the attack vector being trivially exploitable is the real concern. imagine this on a $100M bridge
six attacks in one week at 3.8M total feels low for defi. the real number is probably higher since most teams dont report under 50k losses
$142k is barely news except the arbitrary call pattern keeps repeating across the LayerZero stack. same bug, different contract
n00b_auditor same bug different contract is exactly right. layerzero integrations are basically copy pasting the same flawed pattern
same bug different contract is right. LayerZero integrations are copy-pasting flawed multi-call code without modifying the access control. auditors keep flagging it and projects keep shipping
142K is a rounding error for most protocols but the attack vector being trivially copy-pasteable means the next one will be 8 figures. LayerZero integrations are basically a buffet for attackers at this point
calldata_rat_ 142K is nothing but the attack vector being copy-pasteable across every LayerZero integration means the next hit will be 8 figures. same bug different contract
arbitrary external calls in 2026 are inexcusable. this was a solved problem after the 2017 multisig wallet hacks. every audit checklist has it and projects still ship without it
the LayerZero stack has had the same calldata issue three times now. at what point does the auditor flag it as architectural not incidental
arbitrary external calls in a multi-call contract in 2026. this was lesson 1 from the 2017 Parity wallet hack and projects are still shipping the same flawed pattern
six attacks in one week at 3.8M and BlockSec is basically running a full time incident response desk for DeFi at this point. crazy that arbitrary external calls are still a thing in 2026