ZKsync confirmed a compromised admin account exploited to mint 111M ZK tokens.
The breach triggered criticism, raising concerns about project direction and security.
ZKsync is back in the spotlight, and this time it’s not because of its technological innovation. The team confirmed that one of its internal admin accounts was hacked. The result? Over $5 million in ZK tokens were transferred to a wallet that should have had no access to it.
The incident occurred through an exploit of the “sweepUnclaimed()” function in the airdrop contract, which was supposed to be used only to distribute unclaimed tokens. However, the leaked admin access allowed the attacker to unilaterally mint over 111 million ZK tokens.
JUST IN: ZKSYNC TEAM IDENTIFIES COMPROMISED ADMIN ACCOUNT THAT „TOOK CONTROL OF ~ $5M WORTH OF ZKSYNC TOKENS.”
— BSCN Headlines (@BSCNheadlines) April 15, 2025
According to the ZKsync team, the vulnerability was limited to the distribution contract, and did not affect user
