Zerohash's AUTH Lite account linking lacks ownership verification, allowing deposits to be held until account names match—a potential transfer control vulnerability.
Security & Exploits ·
Zerohash announced AUTH, an account-linking product launched in October 2026 that enables transfers of crypto, stablecoins, and tokenized securities across 600+ connections spanning custodial accounts and self-custody wallets. The system separates connectivity from ownership verification, offering platforms two configurations: AUTH Lite, which links accounts without identity checks and suits low-risk environments, and AUTH Validate, which matches the sending account's name against the receiving customer's KYC record.
In the Validate flow, deposits can arrive on-chain but remain locked in a Processing state until the sender's information is received and the account names match. Auth Lite omits this verification step entirely, creating a potential transfer control gap where deposits could be held or misrouted if account names do not align. Both versions require credential entry and explicit user consent before linking proceeds.
The product emerged from a beta release in August 2026 and is now available to platform partners including Robinhood, Gemini, Coinbase, MetaMask, and Phantom. Several integrations remain labeled beta in the network directory. It remains unclear whether platforms using Auth Lite have implemented additional safeguards to prevent ownership mismatches, or how often name discrepancies occur in practice.