ZKsync Labs Compromised, Attacker Mints $5M Worth of ZK Tokens

A hacker compromised a ZKsync admin account on April 15, minting $5 million worth of unclaimed airdrop tokens, according to a statement from the official ZKsync X account.

A hacker compromised a Zksync admin account on April 15, minting $5 million worth of unclaimed airdrop tokens, according to a statement from the official Zksync X account. The attack was described as isolated, with no user funds affected.

The protocol, which is currently in the process of an airdrop, had three airdrop distribution contracts come under the administrative control of a compromised account, Zksync said in a statement.

The attacker was able to exploit a function called sweepUnclaimed() to mint 111 million unclaimed ZK tokens, and increase the total token supply by 0.45%. As of the latest update, the attacker still had control of most of the stolen funds.

Zksync is coordinating recovery efforts with the Security Alliance (SEAL). According to the protocol, its governance and token contracts are unaffected. The company said that no further exploits are possible via the “sweepUnclaimed()” vector.

Zksync is an Ethereum layer-2 protocol that processes main-layer transactions in batches using a technology called zero-knowledge rollups. The Zksync Era platform has $57.3 million in total value locked as of April 15, according to DefiLlama. Zksync had been in the process of airdropping 17.5% of its token supply to ecosystem participants.

ZK token drops 7% in 24-hour trading

Zksync’s token, ZK (ZK), saw volatile price action in the wake of the hack and the project’s public disclosure on X. Around 1:00 pm UTC, the token had dropped 16%, falling to $0.040 before rebounding to $0.047 at the time of writing.

Despite the bounce, ZK remains down 7% over the past 24 hours.

Overall, $2 billion has been lost to crypto hacks in the first quarter of 2025 alone, just $300 million less than the total lost in 2024.