Abstract

This proposal authorizes the ZKsync Security Council to convert ETH, recovered from the April 2025 exploit of unclaimed airdrop tokens, back into ZK tokens. The assets are currently in the custody of the Security Council following a successful safe harbor resolution with the hacker.

Due to the potential for arbitrage and market manipulation, the methods and timing of the ETH-to-ZK conversion will not be disclosed publicly in advance. By passing this proposal, the Token Assembly affirms its intent to restore the unminted airdrop token supply in ZK form and delegates execution authority to the Security Council, under conditions of post-trade transparency and governance oversight.

Motivation

On April 13th, 2025, a compromised admin key was used to mint ~111.8 million ZK tokens from expired airdrop distributor contracts (see announcement). Following incident response and investigation, the Security Council negotiated a 90% return of the exploited funds. The recovered funds are currently held in Security Council multisigs on ZKsync Era and Ethereum.

The following table summarises the returned funds:

This proposal ensures that the recovered ETH is responsibly converted back into ZK to align with the original intent of ZKsync governance. The recommended action minimizes risk to the protocol and the token by allowing operational discretion to the Security Council, who is trusted with emergency mitigation.

Specification

If this proposal is approved, the ZKsync Security Council is authorized to convert the recovered ETH into ZK tokens, including bridging and/or transferring ETH to a destination that allows for this conversion.

The timing, venue, and method of conversion shall be at the discretion of the Security Council, guided by the best interests of the Token Assembly. Public disclosure of trade details in advance is not required in order to minimize the risk of arbitrage or market manipulation.

Once all recovered ETH has been converted to ZK, the Security Council will transfer the total amount of ZK tokens to governance custody by transferring the tokens to the Token Governor Timelock, which is controlled by the Token Assembly.

A public report will be issued upon completion of the conversion, summarizing the trade method, execution outcomes, and custody details. The Security Council must confirm that no personal gain was derived by the Security Council entity or members of the Security Council from the execution of the trades.

This is a one-time authorization limited to the ETH recovered from the April 2025 exploit.

Other Information

• Incident Report: Compromised Admin Key to Unclaimed Airdrop Tokens
• Returned Funds Onchain Confirmation
• Security Council Safe Harbor Message