Three protocol-layer changes from the last 48 hours: a cross-chain executor compromise active today, a Cardano hard fork entering final countdown, and Aave V3 going live on a ZK rollup with restricted initial caps.
LayerZero: On July 15, PeckShield reported that LayerZero Executor wallets were compromised across eight networks including Ethereum, BNB Chain, Base, Arbitrum, Avalanche, Optimism, Mantle, and Plasma, with approximately $2.4 million drained. The attacker bridged the proceeds to Ethereum and converted most of the assets into 956 ETH and roughly $322,000 in USDC. The executor role in LayerZero handles gas abstraction and on-chain message delivery; a compromise at this layer affects message execution across every chain where the executor was active. LayerZero has not yet published a formal incident report, and the root cause of the wallet access has not been confirmed. Protocols using the LayerZero Labs executor as their default should treat execution delivery on affected chains as an open risk variable until the post-mortem is published.
Cardano: The Van Rossem hard fork initiation was ratified at the epoch 642 boundary on July 13 at 21:45 UTC, completing the DRep, stake pool operator, and Constitutional Committee voting thresholds required under Cardano's Voltaire governance framework. Hard fork enactment is set for July 18 at 21:45 UTC. The upgrade activates Protocol Version 11, an intra-era hard fork that updates the Plutus cost model to reduce smart contract execution fees, introduces new cryptographic primitives, enforces VRF key uniqueness, and revises reference input rules. As of ratification, 93% of current block production was already running node version 11 and exchange readiness by tracked liquidity had cleared 84%. Any stake pool operator, exchange, or infrastructure service still running a legacy node will fall out of sync at the July 18 enactment block. This is the first Cardano hard fork executed entirely through on-chain Voltaire governance without unilateral IOG control.
Aave / zkSync Era: On or around July 10, the Aave DAO executed the activation proposal for Aave V3 on zkSync Era, listing five initial assets: USDC, USDT, WETH, wstETH, and ZK. The pool launched with deliberately low supply and borrow caps, roughly $10,000 per asset, to allow internal testing before the Aave Guardian raises them to governance-approved levels. The deployment uses Aave v3.1 and was re-deployed with zksolc compiler version 1.5.3 after a prior compiler dependency issue was identified and fixed. Pool admin authority sits with the Aave Guardian during the bootstrap period. The activation follows BGD Labs completing a full technical evaluation of the zkSync network infrastructure and risk providers approving asset parameters. Builders and protocols on zkSync Era now have access to Aave's borrowing and collateral infrastructure, with caps expected to scale once the guardian confirms stable operation.
