ZKsync hack — April 2025

On 13 April 2025 at 12:32 UTC an attacker holding a compromised administrative key called sweepUnclaimed() on three Merkle distributor contracts left over from ZKsync's June 2024 ZK token airdrop, minting 111,881,122 ZK tokens to an address they controlled. ZKsync's own incident report values the mint at approximately $5 million at the moment of the transaction. The key belonged to a 1/1 multisig, which retained the right to sweep tokens airdrop recipients had never claimed. ZKsync said the investigation found that the key had been generated by a former contributor and that no evidence of malicious intent on that person's part was found; it has not said how the key was obtained. Between 13 and 15 April the attacker swapped about 67.2 million ZK for ETH and moved roughly 1,116 ETH to Ethereum mainnet. Matter Labs engineers established the scope on the morning of 15 April and the incident was disclosed the same day. ZKsync stated that the ZKsync protocol, the ZK token contract, the three governance contracts and all active capped minters were unaffected and that no user funds were ever at risk, the loss falling on unclaimed airdrop supply. The ZK token fell 8.6% over the following 24 hours. On 21 April at 15:03 UTC the ZKsync Security Council posted an on-chain safe-harbour offer: return 90% of the proceeds within 72 hours and keep 10%. The attacker accepted and returned 90% on 23 April at 14:39 UTC. The recovered assets are held by the Security Council pending a governance decision. The attacker has not been identified.