ZKsync is a network of chains secured by cryptography, not validators. Its cutting-edge ZK innovation enables the privacy, performance and connectivity that businesses need to thrive in the digital assets economy.

Labs / DevCo

Foundation

(a) IP ownership & control

The ZKsync codebase is open source under MIT and Apache 2.0 licenses, publicly maintained on GitHub (github.com/matter-labs/zksync-era and related repositories). The DAO (Token Assembly) does not directly own IP in a traditional sense. However, the Token Assembly can endorse or revoke endorsement of official Protocols via governance vote. The "ZKsync" trademark and brand are owned by Matter Labs. ZKsync Governance Program Systems (ZKGPS), a Cayman Islands Foundation Company governed by Token Assembly Approval, administers Token Program Proposals.

(b) Contract/admin powers

The ZKsync governance system distributes on-chain authority across multiple bodies:

• Token Assembly (Delegates): Votes to approve protocol upgrades (via Protocol Governor), token programs (via Token Governor), and governance advisory proposals (via GovOps Governor). Proposals require delegate approval to progress. Voting power is 1 ZK token = 1 vote, activated through delegation.
• Guardians (8 individuals; Guardian Multisig on Ethereum: 0x600dA620Ab29F41ABC6596a15981e14cE58c86b8): Onchain veto on any Token Governor or GovOps Governor proposal requires 5/8 signers. Offchain veto on Protocol Governor proposals requires 5 signed statements. Can extend the offchain veto period from 3 to 7 days with 2/8 signers. Can approve Protocol Governor proposals during the 30-day Risk Review Period with 5/8 signers if the Security Council is unable or unwilling. One of 3 Emergency Upgrade Signers (5/8 threshold on the Guardian Multisig).
• Security Council (8 members; Security Multisig on Ethereum: 0x66E4431266DC7E04E7d8b7FE9d2181253df7F410): Soft Freeze (12 hours) requires 3/8 signers. Hard Freeze (7 days) requires 6/8 signers. Unfreeze requires 6/8 signers. Approves Protocol Governor proposals in the Risk Review Period with 4/8 signers. One of 3 Emergency Upgrade Signers (6/8 threshold on the Security Multisig). Composition and thresholds per ZIP-15 (April 2026), which reduced the council from 12 to 8 signers and limited membership to entities.
• Emergency Upgrades: Require unanimous approval from all three governance bodies acting through the Emergency Upgrade Multisig: Security Council (6/8), Guardians (5/8), and ZKsync Foundation Multisig (3/5). Emergency Upgrades can be executed whether or not a freeze is active.

(c) Locked-token rights (conditional)

No staking or token-locking mechanism for additional governance rights currently exists. Voting power is 1 ZK token = 1 vote, activated through delegation. There are no boost, lock-based multipliers, or time-weighted voting mechanisms.

(d) Current tokenholder governance rights and economic arrangements

Holders of the ZK Token, issued by the ZKsync Association, can delegate ZK token voting power to Delegates. Delegates, in turn, have the ability to vote to approve protocol upgrades, token programs, sequencer selection, and other governance proposals. Currently, sequencer fees accrue to the designated sequencer, operated by Matter Labs. The Token Assembly has control over 29.3% of the total token supply (21B ZK) at the time of the token launch in June 2024. This allocation can fund initiatives in line with the ZK Credo and ZKsync Governance North Star. Proposals can allocate ZK token minting rights if approved by passing a token program proposal through the Token Governor. "GovOps" via Governance Advisory Proposals (GAPs): GAPs provide legitimacy to off-chain decisions through onchain Token Assembly Delegate voting (e.g. ratification of standards & policies, elections). Reference: docs.zknation.io|forum.zknation.io/t/zknomics-roadmap-vision/712

(e) Control surface reliance

ZKsync is actively progressing toward full decentralization. The sequencer is currently sole-operated by Matter Labs, but decentralized sequencing is under development (supporting Gateway and ZKsync Era, allowing anyone to participate as a sequencer). A decentralized prover pilot launched in Q1 2025, inviting community members to run provers, submit validity proofs, and earn testnet rewards. The governance system itself is already decentralized across the Token Assembly, Guardians, and Security Council. The anticipated evolution includes: implementation of decentralized sequencing, enabling protocol-level interoperability between ZK Chains, and enabling protocol-level fees from sequencers such that all ZK Chains contribute towards ecosystem sustainability.

(f) Dissolution authority

The ZKsync Association (the primary foundation entity) can only be voluntarily dissolved by the General Assembly with a two-thirds majority of valid votes cast. Upon dissolution, the General Assembly must appoint a liquidator and decide on the distribution of remaining assets. After covering liabilities, remaining assets must be used for non-profit, charitable, or ecclesiastical purposes in accordance with §§ 34 ff. of the Austrian Federal Fiscal Code (BAO). The last Board must notify the competent Austrian association authority in writing within four weeks of the dissolution resolution. Separately, ZKsync Governance Program Systems (ZKGPS, the Cayman Foundation Company) may be wound up by its Board (a non-delegable power), and surplus assets upon winding up are distributed as decided by Token Assembly Approval.

(a) Entity

type and jurisdiction Non-profit association under the Austrian Association Act 2002 (Vereinsgesetz 2002), registered office in Vienna, Austria. Ownerless entity with no shares, stock, equity, or similar instruments. LEI: 529900SV858GPLFCQK64. Chairperson: Anamaria Fuiorea.

(b) IP ownership & control

The Association does not hold proprietary IP or trademarks. The ZKsync codebase is open source (MIT/Apache 2.0). The Association operates the governance portal (zknation.io), governance documentation, and related interfaces. The Association is home to the ZKsync Governance Team, which maintains governance infrastructure, oversees system design and updates, and educates the community. Subsidiary entity: ZKsync Governance Program Systems (ZKGPS), an ownerless exempted limited guarantee Foundation Company incorporated in the Cayman Islands (File #414748), which handles KYC/KYB compliance and legal contracts for Token Program Proposals approved by governance.

(c) Powers over DAO, treasury, protocol-controlled resources, and token administration

Powers over DAO, treasury, protocol-controlled resources, and token administration

The ZKsync Association is the issuer of the ZK Token. It operates the governance interfaces and manages content displayed on its controlled online interfaces. The Association's Board provides instructions based on Token Assembly vote outcomes. The Association does not directly control protocol-level treasury assets or capped minters for ecosystem funding — the Ecosystem Initiatives allocation is administered by the ZKsync Foundation, a separate Cayman Islands foundation company (see Sections 7, 11, and 16).

(d) Powers over DevCo

The ZKsync Association holds no equity in, board seats on, or governance authority over Matter Labs and cannot direct Matter Labs' decision-making. The Association is ownerless, non-profit, structurally independent, with no equity and no profit distributions

(e) Contract/admin powers

The Association does not have independent pause or upgrade authority over the protocol. Its role is governance operations and token issuance.

(f) Current economic arrangements and distribution policies

Non-profit; no dividends or profit distributions. No portion of assets, revenues, or profits may be transferred as profit to members or Board members (apart from authorized remuneration for services). The Association relies on donations to fund its operations.

Blockworks note: ZKsync Association (Governance Operator & Token Issuer) The Primary Foundation for ZKsync is the ZKsync Association, the entity that issued the ZK Token at launch in June 2024.

(a) Entity

type and jurisdiction Matter Labs, an exempted company incorporated under the laws of the Cayman Islands (company number 352369). CEO: Alex Gluchowski.

(b) IP ownership & control

Matter Labs owns the “ZKsync” trademark and brand. The ZKsync codebase is open source under MIT and Apache 2.0 licenses, publicly maintained on GitHub. Matter Labs is the primary development organization building and maintaining the protocol, the ZK Stack, Prividium, and handles the majority of enterprise business development alongside the Foundation.

(c) Powers over DAO, treasury, protocol-controlled resources, and token administration

Powers over DAO, treasury, protocol-controlled resources, and token administration

Matter Labs operates the sole sequencer for ZKsync Era and collects L2 transaction fees through this role. Transactions can only be validated through the open-source proof system. Alex Gluchowski (CEO) is one of 8 Guardians with veto power over governance proposals. Matter Labs also holds one of 8 Security Council seats. These are individual governance roles, not formal corporate powers of Matter Labs over the DAO. Matter Labs holds ZK tokens and associated delegate voting rights in the Token Assembly. Where Matter Labs has a conflict of interest, including any Token Program Proposal it submits, it abstains. This is an individual tokenholder right exercised through standard delegation, not a corporate control power.

(d) Powers over Foundation

Matter Labs holds no equity, board seats, or other governance authority over the ZKsync Association, and cannot direct either entity's decision-making. The entities operate at arm's length and are structurally independent.

(e) Contract/admin powers

Alex Gluchowski participates as a Guardian (veto power via Guardian Multisig, 5/8 threshold). Matter Labs is also on the Security Council (freeze/unfreeze, Risk Review approval). These are individual governance roles subject to governance procedures and can be altered by Protocol Governor proposals.

(f) Current economic arrangements and distribution policies

As sole sequencer operator, Matter Labs collects L2 transaction fees (validated through the open-source proof system). ZKsync is in the process of decentralizing the sequencer and validators. Equity holders (Matter Labs, affiliates) hold common/preferred shares that receive no protocol fees or token distributions by default. Matter Labs has stated it does not plan dividends or buy-backs from protocol revenue — equity value is tied to service contracts and IP. Team token allocation (2,845,357,294 ZK, 13.55% of total supply) vest over 4 years with a 1-year cliff (June 2024–June 2028).

(a) Identity & role

APC 1: ZKsync Security Council Identity & role

The ZKsync Security Council consists of 8 entity members who are signers of the Security Multisig (Ethereum: 0x66E4431266DC7E04E7d8b7FE9d2181253df7F410), operating through the ZKsync Security Council Foundation (Cayman Islands) with members bound by contractual agreements and entity bylaws. Per ZIP-15 (April 2026), the council was reduced from 12 to 8 signers and membership was limited to entities only, retaining: ChainLight, Cyfrin, Dedaub, Matter Labs, Nethermind, OpenZeppelin, PeckShield, and Spearbit. Role: protocol security and emergency response, providing an independent technical check on protocol upgrades.

APC 2: ZKsync Guardians Identity & role

The Guardians are 8 named individuals who are signers of the Guardian Multisig (Ethereum: 0x600dA620Ab29F41ABC6596a15981e14cE58c86b8), bound by the bylaws of the ZKsync Guardians entity: Juan Benet, Alex Gluchowski (CEO of Matter Labs), Bartek Kiepuszewski, pcaversaccio, Gabriel Shapiro, Awa Sun Yin, Aleksandr Vlasov, and Eric Wall. Role: governance oversight — protecting the Mission set out in the ZK Credo by reviewing and, where necessary, vetoing governance proposals at their sole discretion. When exercising a veto, Guardians must publish a justification on the ZKsync Forum within 48 hours.

(b) Parameter control & scope

APC 1: ZKsync Security Council Parameter control & scope

No control over economic or protocol parameters. Security powers only: Soft Freeze (12 hours) with 3/8 signers; Hard Freeze (7 days) with 6/8; Unfreeze with 6/8.

APC 2: ZKsync Guardians Parameter control & scope

No direct control over protocol parameters. Oversight powers: onchain veto of Token Governor or GovOps Governor proposals (5/8); offchain veto of Protocol Governor proposals (5 signed statements); extension of the offchain veto period from 3 to 7 days (2/8).

(c) Contract/admin powers

APC 1: ZKsync Security Council Contract/admin powers

Approves Protocol Governor proposals during the 30-day Risk Review Period (4/8 signers). One of 3 Emergency Upgrade Signers (6/8 threshold). Membership changes require a Protocol Governor proposal approved by Delegates (or an Emergency Upgrade in exceptional circumstances).

APC 2: ZKsync Guardians Contract/admin powers

Can approve Protocol Governor proposals during the Risk Review Period (5/8) if the Security Council is unable or unwilling. One of 3 Emergency Upgrade Signers (5/8 threshold).

(d) Compensation and material economic arrangements

APC 1: ZKsync Security Council Compensation and material economic arrangements

Members serve under contractual agreements with the ZKsync Security Council Foundation, on a 6-hour SLA. Monthly compensation is US$3,000 per member, set by governance through ZIP-15 and effective May 1, 2026. No governance, treasury, or administrative influence is tied to this compensation beyond the security powers described above. The ZKsync Security Council Foundation, which is funded via governance, is the entity that distributes funding to the security council members.

APC 2: ZKsync Guardians Compensation and material economic arrangements

A dedicated capped minter provides the Guardians' ZK token allocation (see Section 11, wallet 0x21b27952f8621f54f3cb652630e122ec81dd2dc1). ZKsync Guardian individual compensation is 625k ZK per eligible Guardian; 6 of 8 are eligible, for a total aggregate of 3.75m ZK per year passed via TPP-7.

Blockworks note: Two collective governance bodies materially contribute to protocol security and governance oversight and are disclosed here for completeness, although they are member-based bodies rather than single operating companies: the ZKsync Security Council and the ZKsync Guardians.

There are no other Affiliated Protocol Contributors beyond the entities described in Sections 4 and 5. Market making agreements are disclosed in Section 12. Third-party monitoring is performed by Coinwatch (Track). Engineering contributors such as ScopeLift and Tally have contributed to governance infrastructure but do not have parameter control, admin powers, or material ongoing economic arrangements with the protocol.

(a) Launch supply totals

At TGE on June 17, 2024, ZKsync deployed capped minter contracts allowing for the creation of up to 21,000,000,000 ZK total. Tokens are minted just-in-time rather than pre-minted. At launch: the Airdrop allocation (3,675,000,000 ZK, 17.50%) was unlocked for claiming with no lock-ups. Investor and Team allocations (33.33% combined) were locked with a 1-year cliff. The ZKsync Foundation’s Ecosystem Initiatives allocation (19.90%) and Token Assembly allocation (29.27%) were assigned to capped minter contracts for just-in-time minting, not pre-minted.

(b) Recipient categories & use of funds

All allocation information is publicly available at: docs.zknation.io/zk-token/zk-token

• Token Assembly — 29.27%, 6,146,000,700. To be allocated by the Token Assembly for ecosystem initiatives
• Ecosystem Initiatives — 19.90%, 4,179,000,000. ZKsync Foundation administers ecosystem initiatives supporting growth
• Airdrop — 17.50%, 3,675,000,000. One-time airdrop with no lock ups
• Investors — 19.78%, 4,154,642,006. Investors and advisors
• Team — 13.55%, 2,845,357,294. Matter Labs employees
• TOTAL — 100%, 21,000,000,000

(c) Initial price per token

No fixed offering price at TGE. The ZK token was distributed via a free airdrop, no ICO, public sale, or liquidity bootstrapping mechanism was used. Price discovery occurred on secondary markets after the airdrop distribution began on June 17, 2024. The approximate market price at the start of secondary trading was ~$0.25.

(d) Ticker / market symbol

ZK

(e) Total supply & supply regime

21,000,000,000 ZK maximum supply cap. The supply is not strictly fixed: token supply can be increased through a protocol governance upgrade (approved by the Token Assembly). However, there are no planned supply changes and no programmatic inflation. Tokens are minted just-in-time through capped minter contracts rather than being fully pre-minted.

(f) Initial vesting / release schedules

Investor and team tokens (33.33% combined): 4-year unlock period (June 2024–June 2028) with a 1-year cliff. In June 2025, 3.6% of total supply (~756M ZK) unlocked from the combined Team + Investor pool. After June 2025, a maximum of ~0.826% (~173.4M ZK) unlocks monthly until June 2028. Airdrop (17.50%): no lock-ups. Token Assembly and Ecosystem Initiatives pools use capped minters (just-in-time minting) and are not subject to time-based vesting schedules.

All of the 19.78% of tokens allocated towards investors and the 13.55% of tokens allocated towards Matter Labs team members follow the same vesting schedule: 4-year unlock period (June 2024–June 2028), including a one-year cliff. In June 2025, 3.6% of total supply unlocked. After June 2025, a maximum of 0.8% token supply unlocks monthly until June 2028. Of the 2.845B tokens allocated to the team, 344M tokens vested as of June 2025, with approximately 70.5M tokens unlocking monthly for the next 36 months. Approximately 2.5B tokens are currently allocated. The remaining unallocated tokens will be applied to new employees.

(a) Post-TGE employee lock as % of circulation

Of the 2,845,357,294 ZK team allocation, approximately 2,500,000,000 are currently allocated. As of approximately May 2026 (~11 monthly unlocks post-cliff), an estimated ~1,119M ZK have vested from the team pool. Remaining locked/unvested team tokens: ~1,726M ZK, representing approximately 17.7% of the current circulating supply of 9,768,063,013 ZK. Unallocated team tokens (reserved for future employees): ~345M ZK (~3.5% of circulating supply).

(b) Typical post-TGE vesting schedule

Post-TGE employees adhere to the same four-year unlock structure: 1-year cliff, followed by 36 months of monthly token unlocks.

• Existence: All initial token allocations are disclosed publicly at [docs

  zknation.io/zk-token/zk-token](http://docs.zknation.io/zk-token/zk-token). There areno advisory billings from the Foundation to core-team members. No token-based compensation for advisory commitments exist.

• Total token allocation: N/A

  No token-based advisory allocations.

• Payer entity: N/A

• Description of advisory/services: N/A

• Existence & scope: No KOLs or influencers receive ZK tokens for payment. There are no ongoing or past token-based KOL/influencer relationships.
• Usernames & roles: N/A.
• Token allocation & vesting/locks: N/A.

• Market Maker Name: Pulsar
  • Token Allocation Committed: None — fiat retainer only (0% of supply)
  • Term Duration: N/A
  • Structure Name: Retainer
• Market Maker Name: Auros
  • Token Allocation Committed: None outstanding — agreement concluded
  • Term Duration: Concluded
  • Structure Name: Retainer + Loan-plus-option (Historical)
• Market Maker Name: GSR
  • Token Allocation Committed: 0.18% of the total token supply
  • Term Duration: 16 July 2026
  • Structure Name: Loan-plus-option

Blockworks note: ZKsync has one active market maker agreement, with GSR, structured as a loan-plus-option to support liquidity on select centralized exchanges (CEXs). The agreement is under strict real-time monitoring using Track from Coinwatch (a third-party specialist) to verify use of loan capital including idle tokens. Two further relationships are disclosed for completeness: Pulsar provides market-making services under a fiat retainer only — no ZK tokens have been loaned or allocated (0% of supply). A prior agreement with Auros has concluded, and no ZK tokens remain outstanding under it.

• Exchange Name: N/A -- No exchange listing agreements
  • Token Allocation Committed: N/A
  • Term Duration: N/A
  • Native Token Listing Fees: N/A

Blockworks note: ZKsync confirms that it has no current or past exchange listing agreements. No token allocation, listing fees, or incentive programs were paid to any exchange.

• Token repurchases or secondary-market accumulations (if any): None. No token repurchases or secondary-market accumulation programs exist.
• Protocol-owned liquidity (POL): None. No protocol-owned liquidity deployments exist.
• Liquidity deals / purchased TVL: None. No liquidity deals or purchased TVL arrangements exist.
• Token-secured loans/lines (incl. against unissued tokens): None beyond the market maker loan-plus-option structures disclosed in Section 12 above.

• Series Name: Seed
  • Date Of Sale: September 2019
  • Number of tokens sold: $2m / 169,182,630 ZK (0.81%)
  • Vesting Schedule: 4-yr vesting, 1-yr cliff, monthly unlocks (June 2024–June 2028)
• Series Name: Series A
  • Date Of Sale: March 2021
  • Number of tokens sold: $6m / 509,964,784 ZK (2.43%)
  • Vesting Schedule: 4-yr vesting, 1-yr cliff, monthly unlocks (June 2024–June 2028)
• Series Name: Series B
  • Date Of Sale: November 2021
  • Number of tokens sold: $50m / 1,196,362,881 ZK (5.70%)
  • Vesting Schedule: 4-yr vesting, 1-yr cliff, monthly unlocks (June 2024–June 2028)
• Series Name: Series C
  • Date Of Sale: November 2022
  • Number of tokens sold: $200m / 2,279,131,711 ZK (10.85%)
  • Vesting Schedule: 4-yr vesting, 1-yr cliff, monthly unlocks (June 2024–June 2028)
• Series Name: Total
  • Date Of Sale: —
  • Number of tokens sold: $258m / 4,154,642,006 ZK (19.78%)
  • Vesting Schedule: —

Blockworks note: Matter Labs raised a total of $258 million across multiple rounds for ZKsync protocol development. The aggregate amount of tokens allocated to investors was: 4,154,642,006 ZK, or 19.78% of supply. All investor tokens follow a 4-year vesting cycle post-TGE, with a 1-year cliff. No prior fundraising, OTC or discounted MM sales have occurred.

(a) Entity existence

ZKsync Association (Governance Operator & Token Issuer) — exists.

ZKsync Foundation (Ecosystem Growth) — exists.

Matter Labs (Lab/DevCo) — exists.

Token Assembly (DAO) — exists.

(b) Material sources of funding or economic inflows

• Matter Labs (DevCo): Sequencer profit (L2 transaction fees from sole sequencer operation). Equity fundraising ($258M across Seed, Series A, B, C). Future prover services, managed services and interoperability fees via Gateway (anticipated).
• Token Assembly (DAO): Controls 29.27% of total supply (6,146,000,700 ZK) via the ZK token contract, deployable through governance-approved Token Program Proposals.
• ZKsync Association: Relies on donations. No token allocation for operations. No revenue sources.
• ZKsync Foundation: Ecosystem Initiatives allocation (4,179,000,000 ZK, 19.90% of supply) via capped minters. No other revenue sources.

Currently operative economic rights

• Matter Labs: One currently operative programmatic arrangement exists — as sole sequencer operator, ZKsync Era L2 transaction fees accrue to Matter Labs. This arrangement derives from the current protocol configuration and can be altered by the Protocol Governor proposal (e.g., upon sequencer decentralization). Beyond sequencer fees, no governance-approved, contractual, or programmatic rights exist directing fee-routing, treasury distributions, rewards, or other protocol-controlled resources to Matter Labs or its equity holders.
• Token Assembly (DAO): Holds programmatic control over the 29.27% Token Assembly allocation and may grant minting rights to Token Program administrators via approved TPPs. No currently operative fee-routing to tokenholders, reward programs, or buyback mechanisms exist.
• ZKsync Association: None. No currently operative governance-approved, contractual, or programmatic rights to fee-routing, treasury distributions, rewards, or other protocol-controlled resources exist for the Association.
• ZKsync Foundation: Holds a programmatic right to mint up to its Ecosystem Initiatives cap (4,179,000,000 ZK) through its two capped minter contracts. No fee-routing, treasury distribution, reward, or buyback rights exist in favor of the ZKsync Foundation.

(c) Operational use of resources

• Matter Labs: Protocol development and engineering, sequencer/prover infrastructure operations, ZK Stack development, Prividium, enterprise business development, research, security, team compensation.
• Token Assembly (DAO): Ecosystem development through Token Program Proposals (TPPs) funding onchain, verifiable initiatives aligned with Governance North Star metrics.
• ZKsync Association: Governance system operations and maintenance, governance portal development and hosting, community education and events, documentation, legal and compliance for governance operations.
• ZKsync Foundation: Strategic partnerships and infrastructure funding, ZK Chain acceleration, security audits and bug bounties support, tokenomics/governance innovation, shared oversight and project management for governance programs, branding/marketing coordination, analytics and performance tracking.

(d) Onchain Resource Usage

• Core KPIs and protocol revenue: blockworks.co/analytics/elastic-network/elastic-chains-onchain-activity— independent dashboard of onchain activity and fee flows across the Elastic Network.
• Token program capped minters: dune.com/zk_nation/zksync-token-program-capped-minters— tracks minting activity of all governance-approved capped minters.
• Matter Labs Q1-2025 R&D report: forum.zknation.io/t/matter-labs-q1-2025-deliverables-report/674— quarterly deliverables reporting to the community.
• Governance proposals: vote.zknation.io— live and historical governance proposals and treasury actions.
• General updates: blog.zksync.io, blog.zknation.io, https://forum.zknation.io/— protocol, partnership and governance announcements.
• ZKsync Association annual report: github.com/zksync-association/governance-resources/blob/main/Annual-Reports/ZKsync_Association_Operational_Report_2024-2025.pdf— Association operational and financial reporting.

(a) Date & component affected

April 13, 2025. The compromised component was the admin key of three ZK token Merkle distributor contracts on ZKsync Era L2, used for the June 2024 ZK airdrop. The ZKsync protocol, ZK token contract, all three governance contracts and timelocks, and all active Token Program capped minters were not impacted.

(b) Exploit vector summary

A compromised admin key on a 1/1 multisig (0x842822c797049269A3c29464221995C56da5587D) was used to call the sweepUnclaimed() function on three airdrop Merkle distributor contracts, minting the remaining unclaimed airdrop tokens. The admin multisig had been set up as a 1/1 during initial deployment and was never transitioned to the standard 3/5 threshold or reassigned to the Token Governor as intended. The compromise was enabled by a procedural error that misclassified the risk of the airdrop distributor contracts, resulting in a failure to update their security configuration after the airdrop claim window closed on January 3, 2025. The multisig was generated by a former ZKsync contributor no longer employed at any ZKsync-affiliated entity. The exact method used to compromise the key remains unknown, and the investigation found no evidence of malicious intent by the former contributor.

(c) Quantified impact

111,881,122 ZK tokens were minted (~$5M at the time of the initial transaction). The hacker swapped approximately 67,193,843 ZK for ~1,116 ETH before the exploit was contained. 90% of the funds were returned following a safe harbor bounty offer, with the hacker retaining 10% as a bounty. The returned funds were sent to the Token Governor Timelock and are under the control of the Token Assembly following the approval of GAP-3.

(d) Remediation/response taken

Matter Labs deployed temporary transaction filtering on the ZKsync Era sequencer and L1 forced inclusion queue on April 15, 2025 to prevent further fund movement. The ZKsync Security Council sent an onchain safe harbor offer on April 21, 2025, granting a 10% bounty for return of 90% of funds within 72 hours. The hacker returned 100% of remaining ZK and ETH on April 23, 2025. Transaction filters were fully removed on April 24, 2025. Preventative measures implemented include: scheduled key rotation for all critical multisigs, an updated contract risk assessment policy, deployment of real-time monitoring and alerting for all onchain contracts with ZK token or protocol access, mandatory use of Capped Minter V2 (with pre-specified end dates) for all token programs, and ongoing development of Minter Modifiers with rate limits, mint delay, and minter eligibility features.

(e) Current status

Resolved. Funds were first returned to the Security Council, then following the approval of GAP-3 the funds were sent to the Token Governor Timelock and are now under the control of the Token Assembly. No legal action taken. A security review of all onchain access management confirmed no other contracts with access misconfigurations. No additional ZK tokens can be minted from any of the distributor contracts, as the total capped supply of each has been fully minted.

(f) References (optional)

Full incident report: zksync.io/blog/incident-report-compromised-admin-key (Published April 25,2025)