ZKsync Airdrop Hack: $5 Million Compromised but User Funds Safe

The ZKsync team reported a $5 million theft due to a compromised admin account controlling unclaimed ZK tokens from an airdrop. They assured users their funds are safe and the incident is confined to the airdrop contract. The hacker still possesses 44 million ZK tokens and 2,200 ETH. ZK token prices plummeted but have shown recovery.

On April 15, the ZKsync team discovered that a compromised admin account had been exploited, resulting in the theft of $5 million worth of ZK tokens. These tokens represented the remaining undistributed coins from the ZKsync airdrop. ZKsync assured users that their funds remain secure, clarifying that the ZKsync protocol and ZK token contract are undamaged. They characterised the incident as isolated and linked solely to a compromised key related to the airdrop contract.

The compromised account was responsible for three airdrop distribution contracts, leading to an unauthorised minting of roughly 111 million unclaimed ZK tokens. This incident increased the token supply by approximately 0.45%, which briefly impacted market prices. They confirmed that all potential funds have been minted and no further exploitation from this method is feasible. The hacker retains control of 44 million ZK tokens, valued at $2.1 million, along with 2,200 ETH, approximately $3.4 million.

ZKsync co-founder Alex Gluchowski addressed concerns regarding the unclaimed tokens, stating that the remaining supply was intended to revert to the Token Assembly. An investigation is underway to understand the failure in this process. Gluchowski further stated that the hacker faces criminal consequences, encouraging them to expedite the return of the stolen funds.

Since February, ZKsync’s total value locked has plummeted by nearly 80%, dropping to just over $60 million according to DeFiLlama. Additionally, the platform had initiated airdrops in June 2024, providing 17.5% of its total token supply, amounting to 3.67 billion ZK tokens.

Following the incident, the ZK token’s price fell by 13%, reaching an all-time low of $0.0415, but it has since bounced back slightly to $0.0472. Despite this recovery, the token’s current value represents a significant depreciation of 83% from its peak of $0.262 in December and its all-time high of $0.321 during the airdrop.