On May 13, 2025, the official X accounts of ZKsync and Matter Labs were compromised through a delegated access breach. Hackers used the access to post false announcements, including a fake U.S. SEC investigation warning and a malicious link promoting a fraudulent ZK token airdrop. These posts were quickly removed after the team regained control, but not before causing significant panic among users.
The ZKsync team acted swiftly, disconnecting all delegated accounts and applications to prevent further damage. They deleted all hacker posts and announced an internal investigation to determine the breach's origin. Despite regaining control and increased transparency, at least one affiliated developer cautioned users that some account risks might remain, urging continued vigilance.
The incident led to a sharp decline in the ZK token price, with reports citing an 8% drop within hours. This setback follows a recent history of security concerns—just a month prior, ZKsync's airdrop contract was exploited, with millions in tokens briefly stolen. While most funds from the earlier attack were returned, these repeating breaches have cast doubts on the platform's internal security measures.
Amid these security challenges, ZKsync continues technological growth: the network now achieves full EVM bytecode compatibility, simplifying Ethereum smart contract deployment, and has integrated advanced features like ChonkyBFT consensus and collaboration with QuarkID for digital identity solutions. The team remains focused on both user safety and protocol innovation in the face of adversity.