An Attacker Minted 111 Million ZK Tokens Today

This followed a significant ZKsync breach involving a compromised administrative account tied to the project's airdrop

An attacker has minted 111 million ZK tokens following a significant breach of ZKsync, a popular Layer 2 scaling network for Ethereum.

The incident involved a compromised administrative account key used to access three airdrop distribution contracts. As a result, an unclaimed pool of ZK tokens was exploited to mint an enormous number of tokens.

ZKsync confirmed the details in a statement on X (formerly Twitter), as the news pushed the ZK token price down about 13 percent. The compromised account address was identified as 0x842822c797049269A3c29464221995C56da5587D.

The breach was initially discovered by blockchain security firms, who observed a large-scale minting transaction on the ZKsync Era network.

The attacker specifically targeted a function within the airdrop contracts, which was designed to sweep up unclaimed tokens.

“The attacker called the sweepUnclaimed() function that minted approximately 111 million unclaimed ZK tokens from the airdrop contracts,” ZKsync explained.

This action essentially generated new tokens from the pool designated for users who had not yet claimed their airdrop allocation. The transaction can be viewed on the ZKsync Era blockchain explorer.

The scale of the breach, involving 111 million tokens, clarifies initial reports which estimated a lower figure. While the token’s price varies, the quantity minted represents a substantial portion of the unclaimed airdrop supply.

ZKsync quickly moved to contain the fallout from this specific vulnerability. Despite the compromise affecting the airdrop, officials stated that core infrastructure and user holdings remained safe.

“This incident is contained to the airdrop distribution contracts only,” the statement went on to say. “All the funds that could be minted [via this method] have been minted. No further exploits via this method are possible.”

The project also confirmed the security of key components, separate from the specific point of failure in this breach.

“The ZKsync protocol, ZK token contract, all three governance contracts, and all active Token Program capped minters have not been, and will not be impacted by this incident,” ZKsync stated.

Most of the minted tokens reportedly remain in an account controlled by the attacker (0xb1027ed67f89c9f588e097f70807163fec1005d3).

ZKsync announced coordination efforts aimed at recovery. “We’re coordinating the