May 2025 - ZKSync and The Matter Labs Twitter/X Hack Airdrop Scam - $Unknown (Global)

"ZKsync is an ever expanding verifiable blockchain network, secured by math."

"ZK chains are high performance, verifiable, modular rollups and validiums powered by ZKsync. United in an elastic network, ZK chains can be added or expanded to handle increased transaction volume without affecting costs or hardware requirements for verification."

"ZK chains provide native, frictionless interoperability presented in a consistent and easy-to-use interface. This enables trustless communication and asset transfers between chains leveraging the full range of users and liquidity across the entire ZK chain ecosystem. Unlike traditional, centralized solutions, this protocol relies solely on cryptography for security."

"ZKsync offers secure one-tap onboarding via FaceID/Passkeys, eliminating the need for seed phrases and reducing the risk of hacks. By automatically creating modular smart accounts at the protocol level, ZKsync enables a delightful, customizable UX, allowing users to seamlessly access all ZK chains with what feels like a single account directly from their application."

The phishing message targeting the ZKSync community—"Big News for the ZKSync Community! The first $ZK airdrop is live! Every ZKSync follower is eligible to claim a share of the initial $ZK supply. Check it out."—employs classic social engineering tactics to trick users into engaging with a malicious link. By promising a live airdrop and universal eligibility, it creates a sense of urgency and exclusivity that plays on users' fear of missing out. The fact that it originates from compromised official accounts, like @zksync, adds a false layer of legitimacy and makes the scam more convincing.

Technically, the phishing link usually redirects users to a fraudulent website designed to closely mimic the official ZKSync platform. These sites often use small visual tricks, like Unicode characters in the domain name, to appear authentic. Once users arrive at the site, they are prompted to connect their crypto wallet to "claim" their tokens. However, this interaction is typically a wallet drainer scam: it initiates a malicious contract approval or token transfer, allowing the attackers to drain funds or NFTs from the user's wallet without their clear consent.

These phishing sites may include SSL certificates and cloned UI elements to appear safe and legitimate, while often disabling interactive features like comments or page inspection to hide their malicious intent. The combination of social engineering and technical deception makes these scams particularly dangerous in fast-moving crypto communities.

The amount lost is unknown.

Many users confirmed the compromise, urging others not to click any links and labeling the posts as scams. Some speculated about possible insider involvement or broader security lapses, while others criticized the teams for the lack of immediate updates. A few users highlighted that the malicious content included fake airdrop links, warning it could be a wallet drainer.

ZKSync appears to have recovered access to their account. They posted a notification:

"The ZKsync and Matter Labs X accounts are fully back in the control of the team. We’re looking into how the accounts were hacked, and believe it was through compromised delegated accounts.

All delegated accounts and connected apps have been disconnected, and we’ve deleted any tweets from the hacker."

It is unclear what steps, if any, are being taken to assist affected users.

The matter appears to have been resolved.

Further Analysis

ZKSync, a modular and verifiable blockchain network built on zero-knowledge technology, enables scalable, secure, and user-friendly experiences through interconnected ZK chains and one-tap onboarding. Recently, its official social media accounts were compromised to promote a fake $ZK airdrop, leading to a phishing scam that tricked users into connecting wallets to a fraudulent site designed to drain funds. Community members quickly raised alarms, suspecting insider issues or security lapses. Though ZKSync has since regained control and removed the malicious content, the full impact remains unclear, and it’s uncertain if affected users will receive support.

How Could This Have Been Prevented?

More Cryptocurrency Exchange Hacks/Scams/Frauds

MOne Meta Pro App Allows Anyone To Unwrap Their ETH > > < < Curve Finance Curve.Fi DNS Hijack Malicious Frontend

Sources/Further Reading

t.me/QuadrigaInitiative

/r/QuadrigaInitiative

@QuadrigaInit

info@quadrigainitiative.com

Sign-Ups: 100%

Your use of this site/service accepts the Terms of Use and Privacy Policy. This site is not associated with Ernst & Young, Miller Thompson, or the Official Committee of Affected User. For questions or enquiries, email info@quadrigainitiative.com.

Quadriga Initiative