ZKSync confirmed that it had absolutely recovered roughly $5 million in ZK tokens stolen throughout a current breach involving its airdrop distribution contracts after reaching an settlement with the exploiter.
The announcement, made on social media on April 23, acknowledged that the hacker returned the funds inside a 72-hour “protected harbor” window provided by the protocol’s Safety Council.
In keeping with the group, the returned property are actually held in custody by the Safety Council, with protocol governance figuring out the ultimate resolution on their use. An in depth forensic report on the incident and subsequent restoration is being ready.
Negotiated return avoids escalation
The exploit occurred on April 15 and concerned the unauthorized minting of roughly 111 million ZK tokens, equal to about $5 million on the time, by a compromised admin key.
The vulnerability was confined to ZKSync’s airdrop distribution contracts and didn’t have an effect on the broader protocol infrastructure, ZK token contract, or governance operations.
The attacker bypassed commonplace allocation mechanisms and claimed unclaimed tokens from the community’s first distribution spherical. On-chain knowledge later confirmed that the exploiter swapped roughly $3.5 million in stolen ZK tokens for Ethereum (ETH).
ZKSync assured customers that the incident didn’t compromise buyer funds or core infrastructure.
To keep away from extended authorized proceedings, ZKSync’s Safety Council issued an on-chain message to the attacker, providing a ten% bounty for returning 90% of the exploited funds.
The proposal included particular pockets addresses for transferring ZK and ETH tokens throughout the ZKSync Period community and Ethereum’s mainnet.
The settlement was contingent on the complete return of funds by the acknowledged deadline. ZKSync confirmed the decision of the matter with the property efficiently transferred, including that it gained’t take additional motion towards the attacker.
Governance to determine asset allocation
The recovered property are presently beneath the management of the Safety Council, pending governance deliberation on future dealing with. The incident has prompted renewed scrutiny over sensible contract entry controls, notably concerning admin key safety and airdrop mechanisms.
Regardless of the swift restoration, the exploit quickly inflated the ZK token provide and triggered a market response.
Furthermore, the value of ZK didn’t react to the information, with only a 0.5% enhance because the ZKSync revealed the settlement and restoration of funds.