ZKsync Hacker Accepts Bounty, Returns Nearly $5M in Stolen Crypto

A hacker who drained practically $5 million from Ethereum scaling protocol ZKsync’s airdrop contract has returned the stolen funds throughout the mission’s 72-hour deadline, closing the chapter on the latest exploit.

“We’re happy to share that the hacker has cooperated and returned the funds throughout the secure harbor deadline,” ZKsync posted on X, previously Twitter. “The case is now thought-about resolved.”

The recovered belongings, consisting of over 44.6 million ZK tokens and practically 1,800 ETH, are actually below the custody of the ZKsync Safety Council, which can decide the following steps through governance. 

The deal follows an exploit that happened earlier this week, focusing on a “compromised key” behind the ZK token airdrop contract, which allowed the attacker to mint new tokens and reroute unclaimed funds. 

The attacker then transferred the funds throughout each Ethereum and ZKsync’s personal Layer 2 community.

“All person funds are secure and have by no means been in danger,” ZKsync stated in a Tuesday publish. “The ZKsync protocol and ZK token contract remained safe.”

The protocol responded later by issuing an on-chain message providing the attacker a ten% bounty if 90% of the funds have been returned inside 72 hours. 

If the provide was ignored, ZKsync warned the hacker that the case could be escalated to regulation enforcement to pursue a “full legal investigation.”

The ZK token’s value briefly plunged to $0.04 after the exploit however has since stabilized close to $0.05, down 2.6% over the past 24 hours, in accordance with CoinGecko information.

Following the return of the stolen funds, ZKsync stated {that a} remaining investigation report is within the works and might be revealed as soon as full.

Hackers abound

The incident is the newest in a string of assaults plaguing the crypto sector this yr. In keeping with blockchain safety agency Immunefi, practically $1.6 billion in crypto has already been stolen within the first two months of the yr. 

A separate report from blockchain safety agency CertiK paints an equally regarding image, noting that the primary quarter of the yr noticed a lack of $1.67 billion on account of hacks, scams, and exploits, already accounting for over two-thirds of all stolen funds in 2024. 

A lot of this whole was pushed by the catastrophic Bybit exploit, which alone resulted in $1.45 billion in losses and has raised industry-wide issues about centralized alternate safety practices.

Personal key compromises continued to dominate as a crucial menace vector, accountable for $142.3 million in losses throughout simply 15 incidents. 

Alarmingly, solely 0.38% of stolen funds have been recovered this quarter, down from over 42% within the earlier quarter. In February alone, not a single greenback was returned, the report stated.

In the meantime, Ethereum remained essentially the most focused, struggling practically $1.54 billion in theft throughout 98 incidents. 

Edited by Sebastian Sinclair