ZKsync Confirms $5M Exploit, Says Core Infrastructure Remains Secure

Highlights:

• ZKsync has confirmed that the admin account was hacked, and the attacker stole $5 million worth of unclaimed airdrop tokens.
• The community raises concerns after 110 million new tokens were minted, and 66 million were already sold.
• The ZK token price dropped 17% in 30 minutes after the hack and later showed a small recovery.

The ZKsync team confirmed today that one of its admin accounts had been compromised, allowing an attacker to gain control of around $5 million worth of unclaimed tokens from its airdrop contract. The team released a public statement acknowledging the incident and stated that the breach was limited to the airdrop smart contract.

According to them, the core protocol, the ZK token contract, and all user wallets were not affected. They also mentioned that emergency protocols had been activated and that a full investigation was already underway to determine the extent of the breach.

ZKsync security team has identified a compromised admin account that took control of ~$5M worth of ZK tokens — the remaining unclaimed tokens from the ZKsync airdrop. Necessary security measures are being taken.

All user funds are safe and have never been at risk. The ZKsync…

— ZKsync (∎, ∆) (@zksync) April 15, 2025

While the team attempted to reassure its community that the situation was under control, on-chain data showed that the attacker minted 110 million new ZK tokens. Out of this amount, 66 million have already been sold, raising fresh concerns about market stability. The ZKsync team failed to provide additional details about the sizable token minting despite a promised future update.

🚨 JUST IN: $ZK (#ZkSync) has minted 110 million tokens on-chain, of which 66 million tokens have been sold on-chain. According to the token unlock information, the team and investors' tokens are still locked.

According to the Discord response, the team has been informed and the… pic.twitter.com/F4pgMDqNHe

— Çağrı Yaşar (@Artualist) April 15, 2025

After the security breach, the value of ZK tokens became increasingly unstable. The token value dropped by 17% in only 30 minutes when it fell from $0.0478 to $0.0396. The price briefly rebounded to $0.0471 but has dropped to $0.04587 at press time. In addition, the market cap has dropped to $168.57 million.

Minting Controversy Sparks Embezzlement Allegations Against ZKsync Devs

The minting of 110 million ZK tokens after the exploit led to a wave of criticism from the crypto community. Users have questioned the sudden surge of tokens in the network. Some analysts suggest that the developers used this exploit to hide their token sales on public markets. Some analysts have questioned the timing of the mint.

In addition, another commentator known as Hanky Pym pointed to similarities between this incident and the decline of other tokens that experienced a rapid loss of value. He criticized ZKsync for what he saw as poor handling of its funding and operations. Meanwhile, Zener, the founder of the Web3 project Modularity, said that the team had lost the community’s trust. He noted that the damage caused by this incident might not be easily repaired.

Study zksync, another Mantra?

A project with $400M funding collapsing every day since launch!

Be aware of this shit token. The greedy team deceived their community, farmed users for years but then almost scam with their community airdrop.

Real users got literally pennies to… pic.twitter.com/tyekdVpygD

— Hankypym (@hankypymZero) April 15, 2025

Moreover, several users have speculated that the team may be hiding behind the hack narrative to carry out questionable actions. These allegations have not been addressed in detail by the ZKsync team.

Past Airdrop Issues Add to Community Frustration

The recent ZKsync airdrop distribution in June has intensified the existing discontent among users. ZKsync conducted its token airdrop in June when it distributed 3.675 billion ZK tokens to 695,232 wallets, which equated to 10% of active addresses. The airdrop distribution received criticism because of its unequal nature. The majority of tokens from the airdrop distribution went to fewer than 1% of participants.

The event encountered multiple difficulties stemming from Sybil’s attacks. A single user managed to claim more than 3 million ZK tokens through 85 different wallets. The project’s damaged reputation from previous concerns now faces more uncertainty because of the recent breach of ZKsync.