View source for Ryan Zarick LayerZero Token/Airdrop Twitter/X Phishing

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/ryanzaricklayerzerotokenairdroptwitterxphishing.php}}
{{Unattributed Sources}}

[[File:Ryanzarick.jpg|thumb|Ryan Zarick Collage]]Ryan Zarick is the Co-founder and CTO of LayerZero Labs, a company focused on building the Layer 0 of blockchain. With over 10 years of experience in tech, he has co-founded several companies and held roles like CTO at Buzzdraft. In January 2025, Ryan's Twitter/X account was compromised to promote a pump and dump scheme involving a LayerZero token on Solana, as well as a fake airdrop that tricked users into approving wallet access, causing users like slateronsolana and EseTeLopez to report losses. Although Ryan regained control of his account, there doesn't appear to have been a public acknowledgment/explanation of the incident or any suggestion of compensation for victims.<ref name="odailynews-18254" /><ref name="ryanzarickhomepage-18255" /><ref name="ryanzarickrootdata-18256" /><ref name="layerzerosequoia-18257" /><ref name="ryanzaricktwitter-18258" /><ref name="ryanzaricklinkedin-18259" /><ref name="sosovalue-18260" /><ref name="onesafe-18261" /><ref name="theblock-18262" /><ref name="slateronsolanatweet-18263" /><ref name="lockey374tweet-18264" /><ref name="esetelopeztweet-18265" /><ref name="alanestuvertweet-18266" /><ref name="0xeleganttwitter-18267" /><ref name="zroaiagenttwitter-18268" /><ref name="lebsonwinnertwitter-18269" /><ref name="zroaiagenttwitter-18270" /><ref name="blippychadtwitter-18271" /><ref name="zroaiagenttwitter-18272" /><ref name="trumpvanceagaintwitter-18273" /><ref name="blockchainltdtwitter-18274" /><ref name="rookieofphtwitter-18275" /><ref name="itzpoopstertwitter-18276" /><ref name="unendingfatestwitter-18277" /><ref name="pitermorgantwitter-18278" /><ref name="primordialaatwitter-18279" /><ref name="trenchalertstwitter-18280" /><ref name="13navjottwitter-18281" /><ref name="ppmctweetstwitter-18282" /><ref name="0xeldoradtwitter-18283" /><ref name="ahobowithasticktwitter-18284" />

== About Ryan Zarick ==
Ryan Zarick is the Co-founder and CTO of LayerZero Labs, a Vancouver-based company focused on building the Layer 0 of blockchain. With over 10 years of experience in tech, he has co-founded Minimal AI, Coder Den, and 80Trill, and served as CTO at Buzzdraft. Ryan holds a Master’s degree in Computer Science from the University of New Hampshire.

Ryan Zarick’s has a Medium page focusing on topics related to blockchain technology, interoperability, and LayerZero’s developments. His writings cover technical aspects, such as the design and evolution of features like fungible token coloring (Project ColorTrace), updates on LayerZero's progress (e.g., security updates and new features), and deeper insights into omnichain solutions. He often discusses challenges and advancements in bridging and cross-chain functionality, emphasizing security, scalability, and the future of decentralized systems. Additionally, he writes about key LayerZero initiatives like Stargate and the integration of LayerZero with IBC (Inter-Blockchain Communication).
== About LayerZero ==
LayerZero is a project started by Ryan Zarick, which was aimed at addressing the fragmentation in the crypto space across different Layer 1 blockchains. Its mission is to enable seamless interoperability between these blockchains, allowing users and protocols to interact without the typical barriers that exist due to the separation of networks. Unlike traditional solutions, which often require wrapped assets or complex steps, LayerZero offers a user-friendly approach to unify data at the application level. This enables more efficient interactions and enhances the overall crypto ecosystem by overcoming the limitations caused by blockchain silos.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
"The X account of Ryan Zarick, co-founder and CTO of LayerZero Labs, was briefly compromised and used to post a fraudulent airdrop claim along with a phishing link."
{| class="wikitable"
|+Key Event Timeline - Ryan Zarick LayerZero Token/Airdrop Twitter/X Phishing
!Date
!Event
!Description
|-
|January 12th, 2025 12:58:00 PM MST
|First Compromise Mention
|Twitter user and LayerZero fan Alan Estuver appears to be the first to warn about the compromised Twitter/X account.
|-
|January 12th, 2025 1:06:00 PM MST
|Apparent Intern Firing
|It appears that a user Eoin MacLochlainn (Lockey374) responds to a suggestion that an intern is being fired by the LayerZero team. LayerZero Co-Founder/CEO Bryan Pellegrino reports that they don't even hire interns.
|-
|January 12th, 2025 2:55:00 PM MST
|Pump And Dump Token
|Ryan Zarick's Twitter/X account appears to have been used to promote a pump and dump of a LayerZero token on Solana. Twitter user slateronsolana appears to have fallen victim and  believe that the token was launched by Ryan Zarick himself.
|-
|January 12th, 2025 5:22:00 PM MST
|EseTeLopez Reports Loss
|Twitter/X user EseTeLopez reports that they lost all of their ZRO tokens, presumably due to one of the phishing links.
|}

== Technical Details ==
J86PVo1v3GuVwr9zMoareunKNqw7zCyVLc2sxahdpump

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
Alan Estuver was the first to warn about the hack, followed by a discussion involving Eoin MacLochlainn, who responded to a post suggesting an intern was fired. Bryan Pellegrino clarified that LayerZero does not hire interns. Later, Ryan Zarick's account appeared to promote a pump and dump scheme involving a LayerZero token on Solana, with Twitter user slateronsolana expressing concern that Zarick himself had launched the token. Twitter user EseTeLopez reported losing all of their ZRO tokens, likely due to phishing links tied to the incident.

== Ultimate Outcome ==
While Ryan has recovered his account, there doesn't appear to be any public mention of the incident or any suggestion of compensation for victims.

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="odailynews-18254">[https://www.odaily.news/newsflash/412695 LayerZero Labs CTO的X账户短时被盗并发布钓鱼链接，相关帖子已被删除_快讯-odaily] (Accessed Mar 4, 2025)</ref>

<ref name="ryanzarickhomepage-18255">[https://y.at/%F0%9F%91%91 Personal Homepage Of Ryan Zarick] (Accessed Mar 5, 2025)</ref>

<ref name="ryanzarickrootdata-18256">[https://www2049.rootdata.com/member/Ryan%20Zarick?k=MTM3OTU%3D Ryan Zarick - Rootdata] (Accessed Mar 5, 2025)</ref>

<ref name="layerzerosequoia-18257">[https://www.sequoiacap.com/article/new-partnership-the-legend-of-layerzero/ LayerZero - SequoiaCapital] (Accessed Mar 5, 2025)</ref>

<ref name="ryanzaricktwitter-18258">[https://twitter.com/ryanzarick Ryan Zarick's Twitter Account] (Accessed Mar 5, 2025)</ref>

<ref name="ryanzaricklinkedin-18259">[https://ca.linkedin.com/in/ryanzarick Ryan Zarick's LinkedIn Account] (Accessed Mar 5, 2025)</ref>

<ref name="sosovalue-18260">[https://sosovalue.com/person/ryan-zarick-1844232218540462081 https://sosovalue.com/person/ryan-zarick-1844232218540462081] (Accessed Mar 5, 2025)</ref>

<ref name="onesafe-18261">[https://www.onesafe.io/blog/crypto-hacks-safeguard-digital-assets Crypto Hacks Surge: Safeguard Your Digital Assets - OneSafe Blog] (Accessed Mar 5, 2025)</ref>

<ref name="theblock-18262">[https://www.theblock.co/post/334180/string-of-x-hijacks-continues-as-hackers-access-accounts-of-litecoin-foresight-ventures-and-others https://www.theblock.co/post/334180/string-of-x-hijacks-continues-as-hackers-access-accounts-of-litecoin-foresight-ventures-and-others] (Accessed Mar 5, 2025)</ref>

<ref name="slateronsolanatweet-18263">[https://twitter.com/slateronsolana/status/1878561466715897924 slateronsolana - "is this how you spend your sundays too?" - Twitter/X] (Accessed Mar 5, 2025)</ref>

<ref name="lockey374tweet-18264">[https://twitter.com/Lockey374/status/1878534099339473315 Eoin MacLochlainn - "Cant tell if legit  or making light of the situation? Did you just publicly announce you're sacking somebody before the fact on X?" - Twitter/X] (Accessed Mar 5, 2025)</ref>

<ref name="esetelopeztweet-18265">[https://twitter.com/EseTeLopez/status/1878598432388211077 EseTeLopez - "damn... i just lose all my ZRO :(" - Twitter/X] (Accessed Mar 5, 2025)</ref>

<ref name="alanestuvertweet-18266">[https://twitter.com/alanestuver/status/1878532044289929532 Alan Estuver - "The @ryanzarick account is currently compromised.  Avoid interacting with it until further notice." - Twitter/X] (Accessed Mar 5, 2025)</ref>

<ref name="0xeleganttwitter-18267">[https://twitter.com/0xElegant/status/1878533240006267296 @0xElegant Twitter] (Accessed Mar 5, 2025)</ref>

<ref name="zroaiagenttwitter-18268">[https://twitter.com/ZRO_AI_Agent/status/1878533268368454031 @ZRO_AI_Agent Twitter] (Accessed Mar 5, 2025)</ref>

<ref name="lebsonwinnertwitter-18269">[https://twitter.com/lebsonwinner/status/1878572627557556503 @lebsonwinner Twitter] (Accessed Mar 5, 2025)</ref>

<ref name="zroaiagenttwitter-18270">[https://twitter.com/ZRO_AI_Agent/status/1878532755283447850 @ZRO_AI_Agent Twitter] (Accessed Mar 5, 2025)</ref>

<ref name="blippychadtwitter-18271">[https://twitter.com/BlippyChad/status/1877506996196213208 @BlippyChad Twitter] (Accessed Mar 5, 2025)</ref>

<ref name="zroaiagenttwitter-18272">[https://twitter.com/ZRO_AI_Agent/status/1878533255483301958 @ZRO_AI_Agent Twitter] (Accessed Mar 5, 2025)</ref>

<ref name="trumpvanceagaintwitter-18273">[https://twitter.com/TrumpVanceAgain/status/1878534315266502911 @TrumpVanceAgain Twitter] (Accessed Mar 5, 2025)</ref>

<ref name="blockchainltdtwitter-18274">[https://twitter.com/Blockchain__LTD/status/1878556665999397119 @Blockchain__LTD Twitter] (Accessed Mar 5, 2025)</ref>

<ref name="rookieofphtwitter-18275">[https://twitter.com/rookie_of_Ph/status/1878533089791504650 @rookie_of_Ph Twitter] (Accessed Mar 5, 2025)</ref>

<ref name="itzpoopstertwitter-18276">[https://twitter.com/Itzpoopster/status/1878532710680928410 @Itzpoopster Twitter] (Accessed Mar 5, 2025)</ref>

<ref name="unendingfatestwitter-18277">[https://twitter.com/Unendingfates/status/1878552339381936136 @Unendingfates Twitter] (Accessed Mar 5, 2025)</ref>

<ref name="pitermorgantwitter-18278">[https://twitter.com/piter_morgan/status/1878533396231524785 @piter_morgan Twitter] (Accessed Mar 5, 2025)</ref>

<ref name="primordialaatwitter-18279">[https://twitter.com/PrimordialAA/status/1878536073955189128 @PrimordialAA Twitter] (Accessed Mar 5, 2025)</ref>

<ref name="trenchalertstwitter-18280">[https://twitter.com/trenchalerts/status/1878535763974860961 @trenchalerts Twitter] (Accessed Mar 5, 2025)</ref>

<ref name="13navjottwitter-18281">[https://twitter.com/13_navjot/status/1878545376640438490 @13_navjot Twitter] (Accessed Mar 5, 2025)</ref>

<ref name="ppmctweetstwitter-18282">[https://twitter.com/ppmctweets/status/1878536399445442922 @ppmctweets Twitter] (Accessed Mar 5, 2025)</ref>

<ref name="0xeldoradtwitter-18283">[https://twitter.com/0xEldorad/status/1878540810494300668 @0xEldorad Twitter] (Accessed Mar 5, 2025)</ref>

<ref name="ahobowithasticktwitter-18284">[https://twitter.com/AHoboWithAStick/status/1878567750685352307 @AHoboWithAStick Twitter] (Accessed Mar 5, 2025)</ref></references>