attacker – Earlybirds Invest

A ZKsync admin account was compromised on April 15, which allowed an attacker to mint about $5 million worth of unclaimed ZK tokens.

The breach was confirmed through ZKsync’s official account on X, which stated that this was an isolated event and no user wallets were affected.

ZKsync is a tool built on Ethereum
ETH

$1,579.64

that helps speed up transactions by grouping them together and confirming them at once. The platform had been running an airdrop to give out 17.5% of its total ZK token supply to supporters of the project.

What Are Oracles in Crypto? (Beginner Friendly Animation)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe – We publish new crypto explainer videos every week!

According to an updated post on X, the attacker used access to three airdrop-related contracts and triggered a feature called “sweepUnclaimed()”. This function was meant to handle leftover tokens from the ongoing airdrop.

The attacker created 111 million extra ZK tokens, which increased the total supply by around 0.45%. Most of those tokens still remain in the attacker’s wallet.

ZKsync says its main contracts, including those controlling token rules and community governance, were not affected. The platform has also said that the exploited method cannot be used again.

<br />

To address the situation, ZKsync is working with a cybersecurity group called the Security Alliance (SEAL) to try to recover the stolen funds.

KiloEX, a decentralized exchange (DEX), recently paused all trading after a $7.5 million security breach. How did the attacker pull it off? Read the full story.

Unclaimed Airdrop Tokens Targeted

ZKsync originally airdropped 3.6 billion ZK tokens in June 2024 to reward early adopters of ZKsync Era and ZKsync Lite. Despite this extensive distribution, millions of tokens—amounting to nearly $5 million—remained unclaimed. These tokens resided in three smart contracts overseen by an admin account, which was compromised.

According to ZKsync’s statement, the attacker called a function named sweepUnclaimed() on the airdrop contract, thereby minting 111 million ZK tokens. This move effectively boosted the circulating supply by around 0.45% of a total fixed supply of 21 billion tokens.

The function existed to allow recovery of unclaimed tokens after the claim period but was gated behind admin-only access—an access point that was exploited once the admin key was compromised.

While $5 million is relatively modest compared to the broader crypto space, any unauthorized minting raises concerns about contract security and leftover token handling.

Scope of the Incident

ZKsync emphasizes that this hack was isolated to the airdrop contract and did not affect user wallets or the main ZK token contract. The governance framework and protocol itself remain intact, with no vulnerabilities reported beyond the compromised admin key. Additionally, ZKsync has assured the public that no further exploits are possible through the sweepUnclaimed() function, as the attacker has already taken all mintable tokens.

Still, the situation has reignited debate about contract design and admin key security. Best practices—such as using multisig wallets for critical admin functions, implementing time-locked operations, or designing contracts with immutable parameters—might have mitigated or prevented the breach.

Nevertheless, the incident sparked price volatility. At one point on April 15, ZK’s value had slid 16% to $0.040, though it later rebounded to around $0.047. Still, the token remains down approximately 7% over the past 24 hours, reflecting ongoing market wariness following the hack’s disclosure.

History of the Airdrop

ZKsync’s airdrop in 2024 was significant, allocating a considerable supply of tokens as a reward for ecosystem participants. Users who contributed to ZKsync Era and ZKsync Lite received varying amounts of ZK based on their activity, but a portion stayed unclaimed. These unclaimed tokens ended up centralized under three distribution contracts, ultimately making them a high-value prize for anyone who managed to breach the admin account’s security.

Response and Recovery Efforts

In a move to protect against further damage, ZKsync has enlisted the help of the Security Alliance (SEAL). The attacker’s wallet—containing most of the newly minted tokens—remains closely monitored, and ZKsync has publicly requested that the individual reach out to negotiate the return of funds. If that fails, the company could seek legal channels to address the theft.

ZKsync stresses that the rest of its architecture—including governance mechanisms, bridging components, and token supplies—remains secure. The protocol also claims that leftover vulnerabilities from the compromised admin key have been neutralized and that no additional user-facing security measures are needed at this time.

Looking Forward

While the hack did not involve user deposits or core protocol infrastructure, it raises questions about how leftover airdrop tokens are stored and secured. Distributing tokens to community members can be an effective way to reward early participation, but unclaimed portions may become a single point of failure if they are controlled by one privileged account.

ZKsync’s quick response and transparent communication have helped contain the issue. However, it remains to be seen whether the attacker will willingly return the stolen tokens. As the network continues to grow—it currently has $57.3 million in total value locked, according to DefiLlama—users and developers alike will watch closely to see what additional security measures ZKsync implements to prevent future admin key compromises.