ZKsync and Matter Labs X Accounts Hijacked in Brazen Phishing Attack—Fake ’US Probe’ Claims Amplify Chaos
Another day, another crypto heist—except this time, the hackers went full Hollywood. ZKsync and Matter Labs’ X accounts got swiped in a phishing scam slick enough to make a Wall Street broker blush. Meanwhile, someone’s spreading rumors about a US investigation like it’s free money on a meme coin pump.
Here’s the kicker: the ’probe’ claims are pure fiction. But in crypto, perception moves markets faster than facts—just ask the bagholders from last week’s rug pull.
Security? Still an ’afterthought’ for an industry that treats private keys like disposable Twitter handles. Stay paranoid out there.
ZKsync and Matter Labs X Accounts Hacked: Fake SEC Warnings and Phishing Links Spread Panic
On May 13, 2025, hackers gained unauthorized access to zksync and Matter Labs’ official X accounts, using them to spread misinformation and phishing links.
Warning: Both @zksync and @the_matter_labs accounts have been compromised.
Do not interact with that account or click any links.
Wait for the @zkSyncDevs account to verify when the account has been reclaimed.
We will quote tweet this tweet when @zksync and @the_matter_labs…
According to the latest updates from ZKsync, both accounts have now been secured and are “fully back in the control of the team.”
The ZKsync and Matter Labs X accounts are fully back in the control of the team. We’re looking into how the accounts were hacked, and believe it was through compromised delegated accounts.
All delegated accounts and connected apps have been disconnected, and we’ve deleted any…
The attackers executed a two-pronged assault on the platform’s reputation and token price.
First, the two accounts were used to publish false claims that ZKsync was under investigation by the US Securities and Exchange Commission (SEC) and warned about possible Treasury Department sanctions.
These fake regulatory warnings appeared designed to create panic among investors and traders.
The market reacted swiftly to the false regulatory claims. According to data from CoinGecko, the ZK token price dropped approximately 5% following the hack, trading around $0.07.
This decline occurred despite the token enjoying a rally of nearly 38.5% over the previous week.
Market commentator Harrison Leggio, co-founder of g8keep, noted the unusual nature of the attack, writing: “Instead of dropping a token and stealing a few bucks they decided to scare the living shit out of onchain degens.”
This suggests the attackers may have been more interested in manipulating market sentiment than direct theft.
Shoutout to the zksync hackers.
Instead of dropping a token and stealing a few bucks they decided to scare the living shit out of onchain degens. pic.twitter.com/ltbwd37WMp
Shortly after the regulatory misinformation, the hackers published a second post promoting a fake ZK token airdrop, which included phishing links designed to drain users’ wallets.
According to Matter Labs communications head Lynnette Nolan, the breach likely occurred through “compromised delegated accounts,” which have limited posting privileges on behalf of the main accounts.
These accounts have since been disconnected, and an internal investigation is underway to determine the full extent of the compromise.
The ZKsync and Matter Labs X accounts are fully back in the control of the team. We’re looking into how the accounts were hacked, and believe it was through compromised delegated accounts.
All delegated accounts and connected apps have been disconnected, and we’ve deleted any…
The ZKsync team quickly deleted all malicious tweets after regaining control of the accounts.
Ongoing Security Challenges After Recent Airdrop Exploit
This social media breach represents the second significant security incident for ZKsync in less than a month.
The @TheZKNation has recovered $5 million worth of stolen tokens following a security breach on April 15.#ZKsync #Hackhttps://t.co/sb7iC0RqoR
On April 15, 2025, an attacker exploited admin access to the platform’s airdrop distribution contract and minted 111 million unclaimed ZK tokens worth approximately $5 million.
That earlier incident was eventually resolved when the hacker agreed to return 90% of the stolen tokens, keeping the remaining 10% as a self-declared bounty.
The return was completed on April 23, with the hacker transferring nearly $5.7 million across three transactions to the ZKsync Security Council.
The back-to-back breaches have raised serious questions about ZKsync’s security practices and protocols.
While the April incident was isolated to the airdrop distribution contract, and no user funds were compromised, the recurring nature of security failures may damage trust in the platform.
#Hackers stole more than $92.4 million from #crypto projects in April 2025, while the total loss for the first four months of the year alone surpassed $1.74 billion, according to @Immunefi.https://t.co/YECTPKFNNY
These incidents come when crypto security breaches are becoming increasingly common. According to search result data, approximately $2 billion was lost to crypto hacks in the first quarter of 2025 alone, nearly matching the total losses for all 2024.
