ZKsync Hack $5 Million in Controlled Return

Key Points

• Safe-harbour deals can work—when the attacker’s exit route is narrower than the protocol’s legal leverage.
• Administrative keys remain the soft underbelly of otherwise robust cryptography.
• Industry-wide recovery rates are shrinking fast; ZKsync’s success is the exception, not the rule.

Exploit and Settlement
Late on 23 April an unidentified attacker quietly returned 44.6 million ZK tokens and roughly 1,800 ETH—almost the entire haul from ZKsync’s compromised airdrop contract. The move came inside the protocol’s 72-hour “safe-harbour” window, which offered a 10 per cent bounty in lieu of police involvement. The exploited vector was a single administrative key: inconvenient for the project’s reputation, but thankfully detached from the core protocol and user wallets.

We’re pleased to share that the hacker has cooperated and returned the funds within the safe harbor deadline. As stated in the original Security Council message, the case is now considered resolved.

The assets are now in custody of the Security Council, and the decision on what… https://t.co/X0oejun9Tx

— ZK Nation (@TheZKNation) April 23, 2025

Bounty Economics in Practice
Ten per cent of five million dollars is generous, yet the real calculation was liquidity. Off-loading freshly minted tokens without detonating their price is hard work; accepting an amnesty was the rational choice. For ZKsync the price of silence becomes a line item under “security”—a less than ideal but increasingly common remedy across decentralised finance.

A Grim Quarter for Crypto Security
ZKsync’s orderly restitution is an exception in a dismal landscape. CertiK’s preliminary Q1 figures point to $1.67 billion in losses, with the Bybit exploit alone accounting for $1.45 billion. Recovery rates have collapsed to 0.38 per cent from more than 40 per cent a quarter earlier. Ethereum remains the favourite hunting ground—$1.54 billion drained across 98 incidents—while Layer-2 networks inherit much of the same threat surface, minus the liquidity depth to absorb errors.

🚨The Q1 2025 Hack3d Report is here.

Web3 has already lost over $1.6B this year—with the largest single exploit in the space’s history.

We break it down in this short video. Then dive into the full report for insights that matter.👇🧵 pic.twitter.com/9fuf4NjO7j

— CertiK (@CertiK) April 1, 2025

Governance Questions Ahead
The reclaimed assets now sit in a multisig controlled by the ZKsync Security Council. Governance must decide whether to redistribute tokens to would-be airdrop recipients, allocate them to a revamped security budget, or burn a portion to reset optics. Whichever path is chosen, the episode underscores the importance of hardening operational keys before scale attracts adversaries.

ZKsync avoided lasting damage by leveraging game theory and a modest bounty. Others may not be so fortunate as the cost of lax key management continues to rise.