ZKsync confirms that the administrator address of the airdrop contract has been breached, and approximately 111 million ZKs have been illegally minted

According to the official update from ZKsync, investigations have shown that the administrator address (0x8428... 587D) of the airdrop contract has been compromised. The attacker called the sweetUnchamed() function to illegally mint approximately 111 million ZK tokens from three airdrop contracts, accounting for about 0.45% of the total supply. The event is limited to airdrop distribution contracts, and the ZKsync protocol and its token contracts, governance contracts, and authorized minters are not affected. At present, most of the funds are still in the attacker's address, and the team is coordinating with the SEAL organization and exchange to track and encourage the attacker to return the funds.