ZKSync Recovers $5M in Exploited Tokens After Hacker Accepts Safe Harbor Bounty
A recent security breach in the ZKSync protocol led to the unauthorized minting and theft of approximately $5 million worth of ZK tokens. The hacker exploited a vulnerability in the airdrop distribution contract by leveraging the sweepUnclaimed() function, which allowed them to mint 111 million unclaimed tokens.
In response, the ZKSync Security Council offered a "safe harbor" agreement: if the hacker returned 90% of the stolen funds within a 72-hour window, they would receive a 10% bounty and avoid legal repercussions. The hacker complied, returning approximately $5.7 million in assets, including ZK tokens and Ether (ETH), across three transactions completed within 15 minutes.
Despite the successful recovery, the incident negatively impacted the market perception of ZKSync. The ZK token experienced a price drop of nearly 2%, reflecting investor concerns over the protocol's security measures.
This event underscores the importance of robust security practices in blockchain protocols and highlights the potential effectiveness of "safe harbor" policies in mitigating the consequences of security breaches.
