- ZKSync offered a 10% bounty to the hackers if they would return the tokens. The hacker complied, returning almost $5.7 million worth of stolen tokens, including 45 million ZK tokens and over 1,700 ETH.
- The hack occurred in April, when a hacker accessed ZKSync’s admin account and exploited a vulnerability to mint 111 million unclaimed ZK tokens, worth around $5 million.
ZKsync has recovered more than $5 million worth of crypto, including ZK and ETH, after the platform hacker chose to keep 10% as a reward and sent back the rest.
On the 21st of April, the platform shared a post on X telling the hackers that they had 72 hours from the announcement to return the stolen assets. And if the money got sent to the approved addresses within the time window, the case would be closed with no further action. The hackers worked with them and gave back the stolen tokens within the 72-hour “safe harbor” period.
The hacker returned almost $5.7 million worth of stolen tokens to the platform’s Security Council. There were two transfers made, one on the Zksync Era address and the other on the platform’s security Ethereum address. The first transaction totaled $4.3 million, and the other 776 ETH totaled almost $1.4 million.
The first transfer occurred on April 23 at 2:39:57 pm UTC, and the last one was completed 13 minutes later, all within the 72-hour window set by ZKsync.
In total, the hacker returned almost 45 million ZK tokens and over 1,700 ETH to the council’s controlled addresses. The ZKsync Security Council now holds the returned amount, and later on, a vote will be cast to decide how to use it.
How the Zksync Hack Happened
On April 15, a hacker took advantage of a vulnerability in ZKSync’s system by accessing its admin account. This access gave them control of the airdrop contract’s sweep unclaimed function, allowing them to mint 111 million unclaimed ZK tokens, which are worth about $5 million.
The hack happened when the platform was in the process of distributing 17.5% of ZK’s tokens to active participants within its ecosystem (airdrop). ZKSync confirmed that only three airdrop contracts were affected and that core systems and user funds were safe.
Related Reading | XRP Sheds Gains as Market Cools, Analysts Still See Upside