ZKsync Hacker Accepts Bounty, Returns Practically $5M in Stolen Crypto – Decrypt

A hacker who drained almost $5 million from Ethereum scaling protocol ZKsync’s airdrop contract has returned the stolen funds throughout the mission’s 72-hour deadline, closing the chapter on the current exploit.

“We’re happy to share that the hacker has cooperated and returned the funds throughout the protected harbor deadline,” ZKsync posted on X, previously Twitter. “The case is now thought of resolved.”

The recovered property, consisting of over 44.6 million ZK tokens and almost 1,800 ETH, at the moment are beneath the custody of the ZKsync Safety Council, which is able to decide the subsequent steps through governance. 

The deal follows an exploit that came about earlier this week, focusing on a “compromised key” behind the ZK token airdrop contract, which allowed the attacker to mint new tokens and reroute unclaimed funds. 

The attacker then transferred the funds throughout each Ethereum and ZKsync’s personal Layer 2 community.

“All consumer funds are protected and have by no means been in danger,” ZKsync stated in a Tuesday submit. “The ZKsync protocol and ZK token contract remained safe.”

The protocol responded later by issuing an on-chain message providing the attacker a ten% bounty if 90% of the funds have been returned inside 72 hours. 

If the supply was ignored, ZKsync warned the hacker that the case can be escalated to legislation enforcement to pursue a “full legal investigation.”

The ZK token’s value briefly plunged to $0.04 after the exploit however has since stabilized close to $0.05, down 2.6% over the past 24 hours, in accordance with CoinGecko information.

Following the return of the stolen funds, ZKsync stated {that a} ultimate investigation report is within the works and shall be printed as soon as full.

Hackers abound

The incident is the most recent in a string of assaults plaguing the crypto sector this 12 months. In line with blockchain safety agency Immunefi, almost $1.6 billion in crypto has already been stolen within the first two months of the 12 months. 

A separate report from blockchain safety agency CertiK paints an equally regarding image, noting that the primary quarter of the 12 months noticed a lack of $1.67 billion as a consequence of hacks, scams, and exploits, already accounting for over two-thirds of all stolen funds in 2024. 

A lot of this whole was pushed by the catastrophic Bybit exploit, which alone resulted in $1.45 billion in losses and has raised industry-wide issues about centralized alternate safety practices.

Personal key compromises continued to dominate as a vital risk vector, answerable for $142.3 million in losses throughout simply 15 incidents. 

Alarmingly, solely 0.38% of stolen funds have been recovered this quarter, down from over 42% within the earlier quarter. In February alone, not a single greenback was returned, the report stated.

In the meantime, Ethereum remained essentially the most focused, struggling almost $1.54 billion in theft throughout 98 incidents. 

Edited by Sebastian Sinclair