Question
Provide a narrative description of the purpose of the project.
Response
ZKsync is a network of chains secured by cryptography, not validators. Its cutting-edge ZK innovation enables the privacy, performance and connectivity that businesses need to thrive in the digital assets economy.
Question
For each existing entity, list key team members with full name, official title, and prior experience. Explicitly mark non-existent entities.
Response
Full Name | Official Title | Prior Experience |
|---|---|---|
Alex Gluchowski | CEO, Matter Labs | Director of R&D at Entropy Labs (Sep 2017–Dec 2018, Ethereum R&D, Hong Kong). Co-Founder & CTO of PaulCamper (Oct 2015–Aug 2017, Berlin; grew it into Europe's largest RV-sharing marketplace). Co-Founder & CTO of Somuchmore GmbH (Dec 2013–Sep 2015, Berlin; acquired by Rocket Internet). |
Full Name |
|---|
Official Title
Prior Experience |
|---|
Anamaria Fuiorea | Chairperson, ZKsync Association | Compliance and regulatory executive with over 20 years of experience across fintech, banking, and regulated industries. Has focused her career on designing and scaling compliance, risk management, and anti-financial crime frameworks across Europe, the Middle East, and Asia. Expertise includes fintech, blockchain, and digital assets, with a strong emphasis on operationalizing regulatory requirements. |
Marco Cora | Director, ZKsync Foundation | Director at ZKsync Foundation (Jun 2024–Present). Previously at Matter Labs as SVP Business and Operations (May 2023–Jun 2024) and leading fund raising and VC relationships (Aug 2021–Jun 2024). Prior: 13+ years at Azimut Group (Singapore), including Country Head and CEO of Azimut Investment Management Singapore (Nov 2013–Oct 2021), Portfolio Manager for Tail Hedging and Portfolio Optimisation (Nov 2011–Oct 2021), and Board Member across multiple Azimut entities in Singapore, Australia, and Hong Kong. |
Blockworks note: Information about all of the key executives for ZKsync are publicly available in related documentation and DAO / Onchain Governance Leadership |
Question
Describe DAO governance, powers, economic rights, and control surfaces. If no DAO exists, state so and still address current tokenholder governance rights and economic arrangements.
Response
The ZKsync codebase is open source under MIT and Apache 2.0 licenses, publicly maintained on GitHub (github.com/matter-labs/zksync-era and related repositories). The DAO (Token Assembly) does not directly own IP in a traditional sense. However, the Token Assembly can endorse or revoke endorsement of official Protocols via governance vote. The "ZKsync" trademark and brand are owned by Matter Labs. ZKsync Governance Program Systems (ZKGPS), a Cayman Islands Foundation Company governed by Token Assembly Approval, administers Token Program Proposals.
The ZKsync governance system distributes on-chain authority across multiple bodies:
No staking or token-locking mechanism for additional governance rights currently exists. Voting power is 1 ZK token = 1 vote, activated through delegation. There are no boost, lock-based multipliers, or time-weighted voting mechanisms.
Holders of the ZK Token, issued by the ZKsync Association, can delegate ZK token voting power to Delegates. Delegates, in turn, have the ability to vote to approve protocol upgrades, token programs, sequencer selection, and other governance proposals. Currently, sequencer fees accrue to the designated sequencer, operated by Matter Labs. The Token Assembly has control over 29.3% of the total token supply (21B ZK) at the time of the token launch in June 2024. This allocation can fund initiatives in line with the ZK Credo and ZKsync Governance North Star. Proposals can allocate ZK token minting rights if approved by passing a token program proposal through the Token Governor. "GovOps" via Governance Advisory Proposals (GAPs): GAPs provide legitimacy to off-chain decisions through onchain Token Assembly Delegate voting (e.g. ratification of standards & policies, elections). Reference: docs.zknation.io|forum.zknation.io/t/zknomics-roadmap-vision/712
ZKsync is actively progressing toward full decentralization. The sequencer is currently sole-operated by Matter Labs, but decentralized sequencing is under development (supporting Gateway and ZKsync Era, allowing anyone to participate as a sequencer). A decentralized prover pilot launched in Q1 2025, inviting community members to run provers, submit validity proofs, and earn testnet rewards. The governance system itself is already decentralized across the Token Assembly, Guardians, and Security Council. The anticipated evolution includes: implementation of decentralized sequencing, enabling protocol-level interoperability between ZK Chains, and enabling protocol-level fees from sequencers such that all ZK Chains contribute towards ecosystem sustainability.
The ZKsync Association (the primary foundation entity) can only be voluntarily dissolved by the General Assembly with a two-thirds majority of valid votes cast. Upon dissolution, the General Assembly must appoint a liquidator and decide on the distribution of remaining assets. After covering liabilities, remaining assets must be used for non-profit, charitable, or ecclesiastical purposes in accordance with §§ 34 ff. of the Austrian Federal Fiscal Code (BAO). The last Board must notify the competent Austrian association authority in writing within four weeks of the dissolution resolution. Separately, ZKsync Governance Program Systems (ZKGPS, the Cayman Foundation Company) may be wound up by its Board (a non-delegable power), and surplus assets upon winding up are distributed as decided by Token Assembly Approval.
Question
Describe the Primary Foundation, including entity details, IP ownership, governance or token powers, contract/admin powers, and economic arrangements. If it does not exist, state so explicitly.
Response
type and jurisdiction Non-profit association under the Austrian Association Act 2002 (Vereinsgesetz 2002), registered office in Vienna, Austria. Ownerless entity with no shares, stock, equity, or similar instruments. LEI: 529900SV858GPLFCQK64. Chairperson: Anamaria Fuiorea.
The Association does not hold proprietary IP or trademarks. The ZKsync codebase is open source (MIT/Apache 2.0). The Association operates the governance portal (zknation.io), governance documentation, and related interfaces. The Association is home to the ZKsync Governance Team, which maintains governance infrastructure, oversees system design and updates, and educates the community. Subsidiary entity: ZKsync Governance Program Systems (ZKGPS), an ownerless exempted limited guarantee Foundation Company incorporated in the Cayman Islands (File #414748), which handles KYC/KYB compliance and legal contracts for Token Program Proposals approved by governance.
Powers over DAO, treasury, protocol-controlled resources, and token administration
The ZKsync Association is the issuer of the ZK Token. It operates the governance interfaces and manages content displayed on its controlled online interfaces. The Association's Board provides instructions based on Token Assembly vote outcomes. The Association does not directly control protocol-level treasury assets or capped minters for ecosystem funding — the Ecosystem Initiatives allocation is administered by the ZKsync Foundation, a separate Cayman Islands foundation company (see Sections 7, 11, and 16).
The ZKsync Association holds no equity in, board seats on, or governance authority over Matter Labs and cannot direct Matter Labs' decision-making. The Association is ownerless, non-profit, structurally independent, with no equity and no profit distributions
The Association does not have independent pause or upgrade authority over the protocol. Its role is governance operations and token issuance.
Non-profit; no dividends or profit distributions. No portion of assets, revenues, or profits may be transferred as profit to members or Board members (apart from authorized remuneration for services). The Association relies on donations to fund its operations.
Blockworks note: ZKsync Association (Governance Operator & Token Issuer) The Primary Foundation for ZKsync is the ZKsync Association, the entity that issued the ZK Token at launch in June 2024.
Question
Describe the Primary Developer Company, including entity details, IP ownership, governance or token powers, contract/admin powers, and economic arrangements. If it does not exist, state so explicitly.
Response
type and jurisdiction Matter Labs, an exempted company incorporated under the laws of the Cayman Islands (company number 352369). CEO: Alex Gluchowski.
Matter Labs owns the “ZKsync” trademark and brand. The ZKsync codebase is open source under MIT and Apache 2.0 licenses, publicly maintained on GitHub. Matter Labs is the primary development organization building and maintaining the protocol, the ZK Stack, Prividium, and handles the majority of enterprise business development alongside the Foundation.
Powers over DAO, treasury, protocol-controlled resources, and token administration
Matter Labs operates the sole sequencer for ZKsync Era and collects L2 transaction fees through this role. Transactions can only be validated through the open-source proof system. Alex Gluchowski (CEO) is one of 8 Guardians with veto power over governance proposals. Matter Labs also holds one of 8 Security Council seats. These are individual governance roles, not formal corporate powers of Matter Labs over the DAO. Matter Labs holds ZK tokens and associated delegate voting rights in the Token Assembly. Where Matter Labs has a conflict of interest, including any Token Program Proposal it submits, it abstains. This is an individual tokenholder right exercised through standard delegation, not a corporate control power.
Matter Labs holds no equity, board seats, or other governance authority over the ZKsync Association, and cannot direct either entity's decision-making. The entities operate at arm's length and are structurally independent.
Alex Gluchowski participates as a Guardian (veto power via Guardian Multisig, 5/8 threshold). Matter Labs is also on the Security Council (freeze/unfreeze, Risk Review approval). These are individual governance roles subject to governance procedures and can be altered by Protocol Governor proposals.
As sole sequencer operator, Matter Labs collects L2 transaction fees (validated through the open-source proof system). ZKsync is in the process of decentralizing the sequencer and validators. Equity holders (Matter Labs, affiliates) hold common/preferred shares that receive no protocol fees or token distributions by default. Matter Labs has stated it does not plan dividends or buy-backs from protocol revenue — equity value is tied to service contracts and IP. Team token allocation (2,845,357,294 ZK, 13.55% of total supply) vest over 4 years with a 1-year cliff (June 2024–June 2028).
Question
Identify affiliated protocol contributors and explain their control, funding, or operational relationship to the project. If none exist, state so explicitly.
Response
APC 1: ZKsync Security Council Identity & role
The ZKsync Security Council consists of 8 entity members who are signers of the Security Multisig (Ethereum: 0x66E4431266DC7E04E7d8b7FE9d2181253df7F410), operating through the ZKsync Security Council Foundation (Cayman Islands) with members bound by contractual agreements and entity bylaws. Per ZIP-15 (April 2026), the council was reduced from 12 to 8 signers and membership was limited to entities only, retaining: ChainLight, Cyfrin, Dedaub, Matter Labs, Nethermind, OpenZeppelin, PeckShield, and Spearbit. Role: protocol security and emergency response, providing an independent technical check on protocol upgrades.
APC 2: ZKsync Guardians Identity & role
The Guardians are 8 named individuals who are signers of the Guardian Multisig (Ethereum: 0x600dA620Ab29F41ABC6596a15981e14cE58c86b8), bound by the bylaws of the ZKsync Guardians entity: Juan Benet, Alex Gluchowski (CEO of Matter Labs), Bartek Kiepuszewski, pcaversaccio, Gabriel Shapiro, Awa Sun Yin, Aleksandr Vlasov, and Eric Wall. Role: governance oversight — protecting the Mission set out in the ZK Credo by reviewing and, where necessary, vetoing governance proposals at their sole discretion. When exercising a veto, Guardians must publish a justification on the ZKsync Forum within 48 hours.
APC 1: ZKsync Security Council Parameter control & scope
No control over economic or protocol parameters. Security powers only: Soft Freeze (12 hours) with 3/8 signers; Hard Freeze (7 days) with 6/8; Unfreeze with 6/8.
APC 2: ZKsync Guardians Parameter control & scope
No direct control over protocol parameters. Oversight powers: onchain veto of Token Governor or GovOps Governor proposals (5/8); offchain veto of Protocol Governor proposals (5 signed statements); extension of the offchain veto period from 3 to 7 days (2/8).
APC 1: ZKsync Security Council Contract/admin powers
Approves Protocol Governor proposals during the 30-day Risk Review Period (4/8 signers). One of 3 Emergency Upgrade Signers (6/8 threshold). Membership changes require a Protocol Governor proposal approved by Delegates (or an Emergency Upgrade in exceptional circumstances).
APC 2: ZKsync Guardians Contract/admin powers
Can approve Protocol Governor proposals during the Risk Review Period (5/8) if the Security Council is unable or unwilling. One of 3 Emergency Upgrade Signers (5/8 threshold).
APC 1: ZKsync Security Council Compensation and material economic arrangements
Members serve under contractual agreements with the ZKsync Security Council Foundation, on a 6-hour SLA. Monthly compensation is US$3,000 per member, set by governance through ZIP-15 and effective May 1, 2026. No governance, treasury, or administrative influence is tied to this compensation beyond the security powers described above. The ZKsync Security Council Foundation, which is funded via governance, is the entity that distributes funding to the security council members.
APC 2: ZKsync Guardians Compensation and material economic arrangements
A dedicated capped minter provides the Guardians' ZK token allocation (see Section 11, wallet 0x21b27952f8621f54f3cb652630e122ec81dd2dc1). ZKsync Guardian individual compensation is 625k ZK per eligible Guardian; 6 of 8 are eligible, for a total aggregate of 3.75m ZK per year passed via TPP-7.
Blockworks note: Two collective governance bodies materially contribute to protocol security and governance oversight and are disclosed here for completeness, although they are member-based bodies rather than single operating companies: the ZKsync Security Council and the ZKsync Guardians.
There are no other Affiliated Protocol Contributors beyond the entities described in Sections 4 and 5. Market making agreements are disclosed in Section 12. Third-party monitoring is performed by Coinwatch (Track). Engineering contributors such as ScopeLift and Tally have contributed to governance infrastructure but do not have parameter control, admin powers, or material ongoing economic arrangements with the protocol.
Question
Disclose launch and initial supply details in a single initial allocation schedule covering the token's launch. Include:
Response
At TGE on June 17, 2024, ZKsync deployed capped minter contracts allowing for the creation of up to 21,000,000,000 ZK total. Tokens are minted just-in-time rather than pre-minted. At launch: the Airdrop allocation (3,675,000,000 ZK, 17.50%) was unlocked for claiming with no lock-ups. Investor and Team allocations (33.33% combined) were locked with a 1-year cliff. The ZKsync Foundation’s Ecosystem Initiatives allocation (19.90%) and Token Assembly allocation (29.27%) were assigned to capped minter contracts for just-in-time minting, not pre-minted.
All allocation information is publicly available at: docs.zknation.io/zk-token/zk-token
No fixed offering price at TGE. The ZK token was distributed via a free airdrop, no ICO, public sale, or liquidity bootstrapping mechanism was used. Price discovery occurred on secondary markets after the airdrop distribution began on June 17, 2024. The approximate market price at the start of secondary trading was ~$0.25.
ZK
21,000,000,000 ZK maximum supply cap. The supply is not strictly fixed: token supply can be increased through a protocol governance upgrade (approved by the Token Assembly). However, there are no planned supply changes and no programmatic inflation. Tokens are minted just-in-time through capped minter contracts rather than being fully pre-minted.
Investor and team tokens (33.33% combined): 4-year unlock period (June 2024–June 2028) with a 1-year cliff. In June 2025, 3.6% of total supply (~756M ZK) unlocked from the combined Team + Investor pool. After June 2025, a maximum of ~0.826% (~173.4M ZK) unlocks monthly until June 2028. Airdrop (17.50%): no lock-ups. Token Assembly and Ecosystem Initiatives pools use capped minters (just-in-time minting) and are not subject to time-based vesting schedules.
Question
If there are not post-TGE token compensation plans state explicitly they do not exist. If there are then state the:
Response
All of the 19.78% of tokens allocated towards investors and the 13.55% of tokens allocated towards Matter Labs team members follow the same vesting schedule: 4-year unlock period (June 2024–June 2028), including a one-year cliff. In June 2025, 3.6% of total supply unlocked. After June 2025, a maximum of 0.8% token supply unlocks monthly until June 2028. Of the 2.845B tokens allocated to the team, 344M tokens vested as of June 2025, with approximately 70.5M tokens unlocking monthly for the next 36 months. Approximately 2.5B tokens are currently allocated. The remaining unallocated tokens will be applied to new employees.
Of the 2,845,357,294 ZK team allocation, approximately 2,500,000,000 are currently allocated. As of approximately May 2026 (~11 monthly unlocks post-cliff), an estimated ~1,119M ZK have vested from the team pool. Remaining locked/unvested team tokens: ~1,726M ZK, representing approximately 17.7% of the current circulating supply of 9,768,063,013 ZK. Unallocated team tokens (reserved for future employees): ~345M ZK (~3.5% of circulating supply).
Post-TGE employees adhere to the same four-year unlock structure: 1-year cliff, followed by 36 months of monthly token unlocks.
Question
Disclose token-based compensation for external advisors and service providers (e.g., legal, marketing, technical, growth) funded from the on-chain treasury or token reserves held by the Foundation, Labs/DevCo, or similar entities. You do not need to disclose individual names, roles, salaries, or any advisors receiving fiat-only compensation.
Provide:
Response
Existence: All initial token allocations are disclosed publicly at [docs
zknation.io/zk-token/zk-token](http://docs.zknation.io/zk-token/zk-token). There areno advisory billings from the Foundation to core-team members. No token-based compensation for advisory commitments exist.
Total token allocation: N/A
No token-based advisory allocations.
Payer entity: N/A
Description of advisory/services: N/A
Question
Disclose ongoing KOL/influencer relationships that partially or fully received tokens for payment. Do not need to disclose KOL/influencers that do not receive tokens for payment. Use lettered sub-items:
Response
Question
Publicly label all wallets that hold Unissued Tokens (e.g., foundation, operations, treasury, investor reserve), keep each category in distinct wallets (a unique address per category), and disclose who controls each wallet (DAO multisig, foundation, labs/devco, operations, or contract controller + admin). Include one verification link per wallet (docs or explorer).
Definition: Unissued Supply = tokens authorized by the contract but not yet issued to any party; where they sit (treasury or mint authority) does not change that they are unissued. For instance: if a token has a total supply cap of 1B, and 400M tokens have been issued to investors, the team, and users (whether vested or unlocked), then those 400M count as issued supply. The remaining 600M are authorized but unissued supply, even if they are already minted into a DAO treasury wallet.
Response
Title | Primary Function | Chain | Address | Control Mechanism | Explorer Link |
|---|---|---|---|---|---|
ZKsync Foundation Capped Minter 1 | Capped minter for Foundation ecosystem allocation | ZKsync Era | 0x00d3dc9676572d04665a64ee72a78cf0358f63 82 |
Question
Projects must disclose all material terms of market-making arrangements that affect token liquidity. If the project has no agreements or deals with market makers, state that explicitly; doing so earns full credit. For each market maker, include in a table:
If the project has no agreements or deals with market makers, state that explicitly; doing so earns full credit. If no native tokens were loaned or allocated to market makers, state that explicitly; cash/fiat retainers or fees are not required for this item.
Response
Blockworks note: ZKsync has one active market maker agreement, with GSR, structured as a loan-plus-option to support liquidity on select centralized exchanges (CEXs). The agreement is under strict real-time monitoring using Track from Coinwatch (a third-party specialist) to verify use of loan capital including idle tokens. Two further relationships are disclosed for completeness: Pulsar provides market-making services under a fiat retainer only — no ZK tokens have been loaned or allocated (0% of supply). A prior agreement with Auros has concluded, and no ZK tokens remain outstanding under it.
Question
Projects must disclose all material terms of centralized or decentralized exchange listings that affect token liquidity. For each listing, include in a table:
If the project has no agreements or deals with CEX or DEX, state that explicitly; doing so earns full credit. If no native-token listing fees were paid, state that explicitly; cash/fiat fee amounts are not required for this item.
Response
Blockworks note: ZKsync confirms that it has no current or past exchange listing agreements. No token allocation, listing fees, or incentive programs were paid to any exchange.
Question
If a category does not exist or is not applicable, make that clear in plain language (no specific wording required).
Response
Question
Disclose all prior token sales by the Project — including fundraising rounds, any material OTC sales to investors, and any discounted market-maker sales. For each sale, provide:
If no prior sales occurred, state that explicitly (e.g., "No prior fundraising, OTC, or discounted MM sales have occurred.")
Response
Blockworks note: Matter Labs raised a total of $258 million across multiple rounds for ZKsync protocol development. The aggregate amount of tokens allocated to investors was: 4,154,642,006 ZK, or 19.78% of supply. All investor tokens follow a 4-year vesting cycle post-TGE, with a 1-year cliff. No prior fundraising, OTC or discounted MM sales have occurred.
Question
Provide a narrative description of the Project's material funding sources, economic flows, and operational provisioning, broken out by entity: Foundation, Lab/DevCo, and DAO. If an entity does not exist, state that explicitly. If an entity exists but does not pursue revenue-generating activity, state how it funds or provisions its operations.
Response
ZKsync Association (Governance Operator & Token Issuer) — exists.
ZKsync Foundation (Ecosystem Growth) — exists.
Matter Labs (Lab/DevCo) — exists.
Token Assembly (DAO) — exists.
Currently operative economic rights
Question
If any, list prior exploits or incidents that directly affected the token, token supply, tokenholder balances, token contract, minting controls, burn mechanics, or custody of token supply. This question is not asking about general protocol, application, or smart contract exploits unless the incident directly affected the native token itself. If no prior incidents, state this explicitly (e.g., "No exploits affecting tokenholders or protocol funds as of YYYY-MM-DD").
Response
April 13, 2025. The compromised component was the admin key of three ZK token Merkle distributor contracts on ZKsync Era L2, used for the June 2024 ZK airdrop. The ZKsync protocol, ZK token contract, all three governance contracts and timelocks, and all active Token Program capped minters were not impacted.
A compromised admin key on a 1/1 multisig (0x842822c797049269A3c29464221995C56da5587D) was used to call the sweepUnclaimed() function on three airdrop Merkle distributor contracts, minting the remaining unclaimed airdrop tokens. The admin multisig had been set up as a 1/1 during initial deployment and was never transitioned to the standard 3/5 threshold or reassigned to the Token Governor as intended. The compromise was enabled by a procedural error that misclassified the risk of the airdrop distributor contracts, resulting in a failure to update their security configuration after the airdrop claim window closed on January 3, 2025. The multisig was generated by a former ZKsync contributor no longer employed at any ZKsync-affiliated entity. The exact method used to compromise the key remains unknown, and the investigation found no evidence of malicious intent by the former contributor.
111,881,122 ZK tokens were minted (~$5M at the time of the initial transaction). The hacker swapped approximately 67,193,843 ZK for ~1,116 ETH before the exploit was contained. 90% of the funds were returned following a safe harbor bounty offer, with the hacker retaining 10% as a bounty. The returned funds were sent to the Token Governor Timelock and are under the control of the Token Assembly following the approval of .
Question
Provide a single income statement, expense summary, or comparable operating statement for the primary Foundation or Developer Company. A consolidated or entity-level presentation is acceptable. Balance Sheet and Statement of Cash Flows may be included but are not required. This item is intended to provide transparency into offchain operating resources and expenditures only.
Response
Line Item | Amount |
|---|---|
Blockworks note: - ZKsync Association annual report: github.com/zksync-association/governance-resources/blob/main/Annual-Reports/ZKsync_Association_Operational_Report_2024-2025.pdf |
Question
Identify to the best of your ability the token's current deployments across chains, including project-issued deployments, project-endorsed representations, and, if possible, documented third-party wrapped or bridged representations.
For each entry, provide:
Multiple entries on the same chain are permitted.
Definition: A protocol-level asset is an asset whose balances and transfers are handled directly by the blockchain's core rules, rather than by a token smart contract. For protocol-level assets without a token contract address, enter "No contract address" and identify the asset and chain.
Response
This Token Transparency Filing is provided for general informational purposes only. Blockworks reviews completeness only and does not verify or warrant the accuracy of individual answers. ZKsync is solely responsible for the content, accuracy, and legality of its disclosures.
Capped minter smart contract, ZKsync Foundation
explorer.zks ync.io/addre ss/0x00d3... |
ZKsync Foundation Capped Minter 2 | Capped minter for Foundation ecosystem allocation | ZKsync Era | 0xd78dc27d4db8f428c67f542216a2b236638384 05 | Capped minter smart contract, ZKsync Foundation | explorer.zks ync.io/addre ss/0xd78d... |
Guardians ZK Token Allocation | Capped minter for Guardians | ZKsync Era | 0x21b27952f8621f54f3cb652630e122ec81dd2d c1 | Capped minter, Guardian governance | explorer.zks ync.io/addre ss/0x21b2... |
ZKsync Association ZK Allocation | Capped minter for Association | ZKsync Era | 0x0681e3808a0aa12004fb815ebb4515dc823cfb b4 | Capped minter, ZKsync Association | explorer.zks ync.io/addre ss/0x0681... |
ZKsync Foundation Treasury 1 | Foundation treasury operations | ZKsync Era | 0xc8538a03282eae418237264a3957070efa679 da4 | ZKsync Foundation multisig (3/5) | era.zksync.n etwork/addr ess/0xc853... |
ZKsync Foundation Treasury 2 | Foundation treasury operations | ZKsync Era | 0xea81e12b73696599fdc8ba407e858d7163977 619 | ZKsync Foundation multisig (3/5) | era.zksync.n etwork/addr ess/0xea81... |
Token Assembly Governor Timelock | Governance timelock | ZKsync Era | 0xe5d21a9179ca2e1f0f327d598d464ccf60d89c3 d | Token Assembly (onchain vote) | era.zksync.n etwork/addr ess/0xe5d2... |
Blockworks note: Instead of minting the entire supply at once, ZKsync uses capped minters, smart contracts enabling |
Matter Labs deployed temporary transaction filtering on the ZKsync Era sequencer and L1 forced inclusion queue on April 15, 2025 to prevent further fund movement. The ZKsync Security Council sent an onchain safe harbor offer on April 21, 2025, granting a 10% bounty for return of 90% of funds within 72 hours. The hacker returned 100% of remaining ZK and ETH on April 23, 2025. Transaction filters were fully removed on April 24, 2025. Preventative measures implemented include: scheduled key rotation for all critical multisigs, an updated contract risk assessment policy, deployment of real-time monitoring and alerting for all onchain contracts with ZK token or protocol access, mandatory use of Capped Minter V2 (with pre-specified end dates) for all token programs, and ongoing development of Minter Modifiers with rate limits, mint delay, and minter eligibility features.
Resolved. Funds were first returned to the Security Council, then following the approval of GAP-3 the funds were sent to the Token Governor Timelock and are now under the control of the Token Assembly. No legal action taken. A security review of all onchain access management confirmed no other contracts with access misconfigurations. No additional ZK tokens can be minted from any of the distributor contracts, as the total capped supply of each has been fully minted.
Full incident report: zksync.io/blog/incident-report-compromised-admin-key (Published April 25,2025)
