Pectra Upgrade Delayed After Exploit Hits Sepolia

Crypto News Exploits

Pectra Upgrade Delay: Exploit Causes Empty Blocks on Sepolia

Written by Aaron S.,

Editor-In-Chief

Last Updated: March 10, 2025

Key Takeaways

A deposit contract error in Ethereum’s Pectra upgrade led to empty blocks on the Sepolia testnet;
An attacker exploited a zero-token transfer loophole to repeatedly trigger the issue;
Developers applied a private fix and postponed the full rollout for further testing.

Stop overpaying - start transferring money with Ogvio. Join the waitlist & grab early Rewards NOW! 🎁

Pectra Upgrade Delay: Exploit Causes Empty Blocks on Sepolia

BITDEGREE IN YOUR SOCIAL FEED

Ethereum ETH $3,024.95 developers faced issues when rolling out the Pectra upgrade on the Sepolia testnet on March 5.

After the update went live at 7:29 AM, Ethereum developer Marius van der Wijden noticed error messages on their geth node, along with empty blocks being mined. The issue stemmed from a mistake in the deposit contract, which triggered a transfer event instead of a deposit event.

While a fix was quickly introduced, it did not account for every scenario. An unknown user took advantage of this by sending a zero-token transfer to the deposit address, which triggered the same problem again.

What Is Tether? (USDT SIMPLY Explained With Animations)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

Marius explained, "After a few minutes we saw a lot of empty blocks again, so we looked again into the transaction pools and found another offending transaction that triggered the same edge cases".

At first, developers suspected a trusted validator had made an error. However, further investigation revealed the transaction came from a newly created account funded by a faucet. Since the ERC-20 standard allows zero-token transfers, this loophole gave the attacker a way to cause disruptions.

To stop the issue, developers implemented a private fix, which blocked all transactions interacting with the deposit contract.

Following the Sepolia incident, developers have decided to postpone the full rollout until further testing is completed.

Recently, 1inch detected a security flaw that allowed an attacker to steal $5 million from resolvers, third-party entities executing trades. How did this happen? Read the full story.