ZKsync X Accounts Hacked To Promote Fake SEC Warnings and Malicious Airdrop

ZKsync, a verifiable blockchain network built on Ethereum, and Matter Labs X (formerly Twitter) accounts were attacked during the early hours of Tuesday, May 13th, 2025.

At exactly 1:26 AM (UTC+1), ZKsync Developers posted on their X account that both ZKsync and Matter Labs X accounts had been compromised and taken over by hackers promoting fake airdrops and disseminating unfounded claims that the U.S. SEC was investigating ZKsync.

Furthermore, the tweet warned individuals to keep away from the accounts and avoid any interaction with them.

The tweet added that the ZKsync Developers X handle, @zkSyncDevs, is the only authentic account that can declare when the two hacked accounts have been recovered. So, any announcement should be disregarded.

Afterwards, at exactly 2:23 AM (UTC+1), a tweet emerged from the two hacked X accounts, ZKsync and Matter Labs, stating that the situation had been rectified and the two accounts were back under the team’s control.

Adding that all delegated accounts and connected apps that were compromised have been successfully disconnected, and all tweets with phishing links have also been deleted.

However, at 5:45 AM (UTC+1), ZKsync Developers, through its X account, debunked the news of the recovery and stated that the hackers were still in control of the accounts.

ZKsync Developers Revoked All Delegated Access

Thankfully, at 9:59 AM (UTC+1), the ZKsync Developers announced that they had revoked all delegated access and disconnected third-party apps connected to the two hacked X accounts.

Additionally, the team is working internally with X to find a solution. Similarly, tweets from both X accounts are put on hold until the investigation is 100% complete.

Several comments have trailed the hack incident. Some criticise ZKsync for negligence and inability to secure its social media accounts, let alone people’s funds.

While others see it as an attempt to dump ZKsync’s token price, the token was down by 5% after the fake news of the SEC investigation broke out.

Notably, this attack came less than a month after the 15th of April 2025 incident, when the ZKsync admin account was compromised.

This led to the theft of the remaining unclaimed tokens from the ZKsync airdrop, which were worth $5M.

Luckily, the hacker returned 90% of the funds after accepting ZKsync’s offer to keep 10% and return the remaining.

Bad Actors are Frequently Targeting the Crypto Industry

According to Chainanalysis, Crypto hacking remains a persistent threat, with more than a billion dollars worth of crypto stolen.

For example, in March 2025, PackShield, a blockchain security firm, reported 20 crypto hacks totalling $33.46M in losses. The incidents contributed to a staggering $1.63B stolen in Q1, marking a 131% YoY surge and highlighting vulnerabilities in DeFi protocols and blockchain security.