Hacker mints $5M in ZK tokens after admin account breach

A hacker exploited a ZKsync (CRYPTO:ZK) administrative account on April 15, minting $5 million worth of unclaimed airdrop tokens.

The attacker used the “sweepUnclaimed()” function to generate approximately 111 million ZK tokens, increasing the total token supply by 0.45%, according to ZKsync’s official statement.

The compromised account had administrative control over three airdrop distribution contracts.

While the attack significantly impacted the token supply, ZKsync assured users that their funds and the protocol’s core infrastructure remain secure.

“This was an isolated incident confined to the airdrop smart contract,” ZKsync stated, adding that no further exploits are possible through the same vulnerability.

ZKsync is actively coordinating recovery efforts with the Security Alliance (SEAL) and exchanges to recover the stolen funds.

The team has identified the attacker’s wallet address and encouraged them to negotiate for the return of the tokens.

The breach occurred as ZKsync was in the process of distributing 17.5% of its total token supply through an airdrop program.

The unauthorised minting caused significant market disruption, with ZK token prices dropping 16% shortly after the incident.

Although prices partially recovered to $0.047, they remain down by 7% over the past 24 hours.

The hack highlights ongoing security challenges in the cryptocurrency sector, where vulnerabilities in key administrative accounts can lead to significant financial losses.

According to industry data, crypto hacks have resulted in $2 billion in losses during the first quarter of 2025 alone, nearly matching total losses from 2024.

ZKsync is an Ethereum (CRYPTO:ETH) layer-2 protocol that uses zero-knowledge rollups to process transactions more efficiently.

Its platform currently holds $57.3 million in total value locked, according to DefiLlama data as of April 15.

Despite this setback, ZKsync emphasised that its governance and token contracts remain unaffected and that user funds were never at risk.

At the time of reporting, the ZKsync (ZK) price was $0.04766.