Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/zksyncigniteairdropphishingtwitterxcompromised.php}} {{Unattributed Sources}} ZkSync Logo/HomepageThe ZKSync ecosystem, built on high-performance, verifiable, modular rollups and validiums, emphasizes secure, frictionless interoperability across chains, with a user-friendly interface and cryptographic security. The platform also offers secure onboarding with Fa..."

2025-03-10T18:10:16Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/zksyncigniteairdropphishingtwitterxcompromised.php}} {{Unattributed Sources}} thumb|ZkSync Logo/HomepageThe ZKSync ecosystem, built on high-performance, verifiable, modular rollups and validiums, emphasizes secure, frictionless interoperability across chains, with a user-friendly interface and cryptographic security. The platform also offers secure onboarding with Fa..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/zksyncigniteairdropphishingtwitterxcompromised.php}}
{{Unattributed Sources}}

[[File:Zksync.jpg|thumb|ZkSync Logo/Homepage]]The ZKSync ecosystem, built on high-performance, verifiable, modular rollups and validiums, emphasizes secure, frictionless interoperability across chains, with a user-friendly interface and cryptographic security. The platform also offers secure onboarding with FaceID/Passkeys, eliminating the need for seed phrases and enhancing protection against hacks. On January 15th, 2025, the ZKSync team tweeted about their @ZKsyncIgnite account being compromised, urging users not to interact with it or click any links and to wait for confirmation from the official @zksync account when the account is reclaimed. Three days later, on January 18th, the @ZKsyncIgnite account tweeted that they were back, signaling the return of normal operations. There is no word on anyone being affected or any support for affectd users.<ref name="zksynctweet1-18448" /><ref name="zksyncignitetweet2-18449" /><ref name="zksyncignitetweet3-18450" /><ref name="zksyncignitetwitter-18451" /><ref name="zksynchomepage-15546" /><ref name="itislumberjacktwitter-18452" /><ref name="orangantijeeva1twitter-18453" /><ref name="dinomaxzktwitter-18454" /><ref name="lisancyttwitter-18455" /><ref name="mamamironitwitter-18456" /><ref name="neuroparanoidtwitter-18457" /><ref name="coinwatchernewstwitter-18458" /><ref name="0xilbiscionetwitter-18459" /><ref name="galaxyhubaitwitter-18460" /><ref name="zksyncindonesiatwitter-18461" /><ref name="zkamigostwitter-18462" /><ref name="cryptowalker46twitter-18463" /><ref name="bitbullnoahtwitter-18464" /><ref name="aegisweb3twitter-18465" /><ref name="cryptopelucatwitter-18466" /><ref name="nserectwitter-18467" /><ref name="cryptoyaguartwitter-18468" /><ref name="pedrocrypt1twitter-18469" /><ref name="zksyncindonesiatwitter-18470" /><ref name="timallardtwitter-18471" /><ref name="frogmonkeetwitter-18472" /><ref name="metaverticotwitter-18473" /><ref name="mosi115twitter-18474" /><ref name="crypto4tweettwitter-18475" /><ref name="13navjottwitter-18476" /><ref name="nnovadefitwitter-18477" /><ref name="jumperexchangetwitter-18478" /><ref name="fsnangelotwitter-18479" /><ref name="gadgeteerthtwitter-18480" /><ref name="gangcointwitter-18481" /><ref name="aischrodingertwitter-18482" /><ref name="priewpetertwitter-18483" /><ref name="cryptobitsaitwitter-18484" /><ref name="certikalerttwitter-18485" /><ref name="detefabulanartwitter-18486" /><ref name="frogmonkeetwitter-18487" /><ref name="xraisefitwitter-18488" /><ref name="koolcryptovctwitter-18489" /><ref name="0xchesstwitter-18490" />

== About ZKSync ==
"ZKsync is an ever expanding verifiable blockchain network, secured by math."

"ZK chains are high performance, verifiable, modular rollups and validiums powered by ZKsync. United in an elastic network, ZK chains can be added or expanded to handle increased transaction volume without affecting costs or hardware requirements for verification."

"ZK chains provide native, frictionless interoperability presented in a consistent and easy-to-use interface. This enables trustless communication and asset transfers between chains leveraging the full range of users and liquidity across the entire ZK chain ecosystem. Unlike traditional, centralized solutions, this protocol relies solely on cryptography for security."

"ZKsync offers secure one-tap onboarding via FaceID/Passkeys, eliminating the need for seed phrases and reducing the risk of hacks. By automatically creating modular smart accounts at the protocol level, ZKsync enables a delightful, customizable UX, allowing users to seamlessly access all ZK chains with what feels like a single account directly from their application."
== About ZKSync 100M Airdrop ==
"ZKsync 100M Airdrop is Live! The next phase of ZKsync Ignite program continues with 100M ZK tokens available to be claimed today by eligible users. Claim now."

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - ZKsync Ignite Airdrop Phishing Twitter/X Compromised
!Date
!Event
!Description
|-
|January 15th, 2025 6:46:00 PM MST
|ZKSync Team Tweets
|In what appears to be the first mention of any trouble, the ZKSync team tweets about their account having been compromised, warning users not to interact with or click any links from the @ZKsyncIgnite account. They advise waiting for verification from the official @zksync account to confirm when the compromised account has been reclaimed. The team will provide an update via a quote tweet once @ZKsyncIgnite has been recovered.
|-
|January 18th, 2025 9:38:00 AM MST
|Ignite Account Back Tweet
|The ZKIgnote account posts to notify their community that they are "back to pumping [their] bags".
|-
|January 20th, 2025 1:30:00 AM MST
|Again Ignite Account Back
|The ZKIgnite account again posts to indicate that they are back, announcing that their X account has been officially reclaimed and is now fully under their control, making it safe to engage with them again. They also mention that Period 2 has started, with attractive APRs, encouraging users to stack ZK rewards.
|}

== Technical Details ==
This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
"The ZKsync team tweeted that the @ZKsyncIgnite account has been compromised. Do not interact with the account or click any links. Wait for the @zksync account to confirm when the account has been reclaimed."

"Warning: The @ZKsyncIgnite account has been compromised.

Do not interact with that account or click any links. Wait for the @zksync account to verify when the account has been reclaimed.

We will quote tweet this tweet when @ZKsyncIgnite has been recovered."

== Ultimate Outcome ==
"We're back to pumping our bags."

"We’re So Back—Just in Time for Period 2

Our X account is officially reclaimed and fully under our control. It’s safe to engage with us again.

Now, back to business: Period 2 has started, and the APRs are looking [hot.]

Go stack those ZK rewards"

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="zksynctweet1-18448">[https://twitter.com/zksync/status/1879706778688266499 ZKSync - "Warning: The @ZKsyncIgnite account has been compromised. Do not interact with that account or click any links. Wait for the @zksync account to verify when the account has been reclaimed. We will quote tweet this tweet when @ZKsyncIgnite ...ter/X] (Accessed Mar 10, 2025)</ref>

<ref name="zksyncignitetweet2-18449">[https://twitter.com/ZKsyncIgnite/status/1880656058236142032 ZKSync - "We're back to pumping our bags." - Twitter/X] (Accessed Mar 10, 2025)</ref>

<ref name="zksyncignitetweet3-18450">[https://twitter.com/ZKsyncIgnite/status/1881257939924861422 <nowiki>ZKSync - "We’re So Back—Just in Time for Period 2. Our X account is officially reclaimed and fully under our control. It’s safe to engage with us again. Now, back to business: Period 2 has started, and the APRs are looking [hot]. Go stack th...ter/X</nowiki>] (Accessed Mar 10, 2025)</ref>

<ref name="zksyncignitetwitter-18451">[https://twitter.com/ZKsyncIgnite ZKSync Ignite Twitter Account] (Accessed Mar 10, 2025)</ref>

<ref name="zksynchomepage-15546">[https://zksync.io/ ZKsync] (Accessed Sep 18, 2024)</ref>

<ref name="itislumberjacktwitter-18452">[https://twitter.com/ItisLumberjack/status/1879916267270008866 @ItisLumberjack Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="orangantijeeva1twitter-18453">[https://twitter.com/orangantijeeva1/status/1879867247092810029 @orangantijeeva1 Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="dinomaxzktwitter-18454">[https://twitter.com/DinoMaxZK/status/1879925878244991041 @DinoMaxZK Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="lisancyttwitter-18455">[https://twitter.com/Lisancyt/status/1879751064511209681 @Lisancyt Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="mamamironitwitter-18456">[https://twitter.com/MamaMironi/status/1879945899503423669 @MamaMironi Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="neuroparanoidtwitter-18457">[https://twitter.com/neuroparanoid/status/1879708272288231608 @neuroparanoid Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="coinwatchernewstwitter-18458">[https://twitter.com/CoinwatcherNews/status/1879867289027420193 @CoinwatcherNews Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="0xilbiscionetwitter-18459">[https://twitter.com/0xiLBiscione/status/1879708283818389839 @0xiLBiscione Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="galaxyhubaitwitter-18460">[https://twitter.com/GalaxyhubAI/status/1880023706715693235 @GalaxyhubAI Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="zksyncindonesiatwitter-18461">[https://twitter.com/zkSyncIndonesia/status/1879918267340661207 @zkSyncIndonesia Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="zkamigostwitter-18462">[https://twitter.com/ZKamigos/status/1879916511814705449 @ZKamigos Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="cryptowalker46twitter-18463">[https://twitter.com/CryptoWalker46/status/1879919072667959626 @CryptoWalker46 Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="bitbullnoahtwitter-18464">[https://twitter.com/bitbullnoah/status/1879766614247461234 @bitbullnoah Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="aegisweb3twitter-18465">[https://twitter.com/AegisWeb3/status/1879787554230476893 @AegisWeb3 Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="cryptopelucatwitter-18466">[https://twitter.com/cryptopeluca/status/1879804138923638924 @cryptopeluca Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="nserectwitter-18467">[https://twitter.com/NSerec/status/1879916441098731776 @NSerec Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="cryptoyaguartwitter-18468">[https://twitter.com/Crypto_Yaguar/status/1879768667250184367 @Crypto_Yaguar Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="pedrocrypt1twitter-18469">[https://twitter.com/pedrocrypt1/status/1879916336270512217 @pedrocrypt1 Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="zksyncindonesiatwitter-18470">[https://twitter.com/zkSyncIndonesia/status/1879707027376840817 @zkSyncIndonesia Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="timallardtwitter-18471">[https://twitter.com/TimAllard/status/1879921266175697322 @TimAllard Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="frogmonkeetwitter-18472">[https://twitter.com/frogmonkee/status/1879915727542726872 @frogmonkee Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="metaverticotwitter-18473">[https://twitter.com/MetaVertico/status/1879916411273048144 @MetaVertico Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="mosi115twitter-18474">[https://twitter.com/mosi115/status/1879916652521005186 @mosi115 Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="crypto4tweettwitter-18475">[https://twitter.com/Crypto4Tweet/status/1879935522937913715 @Crypto4Tweet Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="13navjottwitter-18476">[https://twitter.com/13_navjot/status/1879915406661664985 @13_navjot Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="nnovadefitwitter-18477">[https://twitter.com/NNovaDefi/status/1879917068365287455 @NNovaDefi Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="jumperexchangetwitter-18478">[https://twitter.com/JumperExchange/status/1879778193533817024 @JumperExchange Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="fsnangelotwitter-18479">[https://twitter.com/FsnAngelo/status/1879988485643465130 @FsnAngelo Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="gadgeteerthtwitter-18480">[https://twitter.com/gadgeteerth/status/1879706991469408263 @gadgeteerth Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="gangcointwitter-18481">[https://twitter.com/Gangcoin/status/1879915354958581792 @Gangcoin Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="aischrodingertwitter-18482">[https://twitter.com/ai_schrodinger/status/1879709078064382359 @ai_schrodinger Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="priewpetertwitter-18483">[https://twitter.com/PriewPeter/status/1879707210940584095 @PriewPeter Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="cryptobitsaitwitter-18484">[https://twitter.com/Cryptobits_ai/status/1879927438962200752 @Cryptobits_ai Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="certikalerttwitter-18485">[https://twitter.com/CertiKAlert/status/1879728152790061449 @CertiKAlert Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="detefabulanartwitter-18486">[https://twitter.com/deTEfabulaNar_/status/1880096781025062987 @deTEfabulaNar_ Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="frogmonkeetwitter-18487">[https://twitter.com/frogmonkee/status/1879918574468522389 @frogmonkee Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="xraisefitwitter-18488">[https://twitter.com/xraise_fi/status/1879746513926230103 @xraise_fi Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="koolcryptovctwitter-18489">[https://twitter.com/koolcryptovc/status/1879931711456505905 @koolcryptovc Twitter] (Accessed Mar 10, 2025)</ref>

<ref name="0xchesstwitter-18490">[https://twitter.com/0xChess/status/1879927850272423989 @0xChess Twitter] (Accessed Mar 10, 2025)</ref></references>

ZKsync Ignite Airdrop Phishing Twitter/X Compromised - Revision history