Technical Analysis of Recent DeFi Hacks: ZKsync and KiloEx Exploits

The decentralized finance (DeFi) sector continues to experience rapid innovation and growth—but this momentum has also made it a lucrative target for cybercriminals. In April 2025, two high-profile exploits targeting ZKsync and KiloEx resulted in combined losses exceeding $12 million. These incidents exposed critical vulnerabilities in smart contract design, key management, and oracle infrastructure. This technical breakdown analyzes the attack vectors, execution methods, impacts, and broader implications for DeFi security. All findings are supported by on-chain data, X (Twitter) disclosures, and credible external reports.

ZKsync Exploit: Compromised Admin Account

•Overview

On April 15, 2025, ZKsync, an Ethereum Layer-2 protocol utilizing zero-knowledge rollups, reported a security breach involving the compromise of an admin account. The attacker minted 111 million ZK tokens from airdrop distribution contracts, valued at approximately $5 million. This inflated the token supply by 0.45%. Importantly, the breach was contained to the airdrop contracts, with no user funds or core protocol contracts affected.

Technical Breakdown

•Attack Vector:The breach stemmed from private key leakage—likely through phishing or poor key management—granting unauthorized access to a privileged admin address:(0x842822c797049269A3c29464221995C56da5587D)

SlowMist Hacked - SlowMist Zone

SlowMist Zone

•Execution: Using the compromised key, the attacker called the vulnerable sweepUnclaimed() function across three airdrop contracts. This function lacked proper access controls and allowed the minting of unclaimed tokens.

•Containment: ZKsync confirmed that only airdrop contracts were impacted. The vulnerable function was disabled, and the core protocol remained uncompromised.

https://x.com/zksync/status/1912569616150458389?s=46

Impact

• Financial: Approximately $5 million in tokens were minted and remained under the attacker’s control at the time of reporting.
• Market Reaction: The ZK token dropped 16% to $0.040, later recovering to $0.047, signaling a net 24-hour loss of 7%.
• Reputation: The incident damaged confidence in ZKsync’s airdrop campaign and raised concerns over its internal security practices.

https://bitcoinethereumnews.com/tech/kiloex-offers-bounty-as-zksync-investigates-admin-breach/

Response & Mitigation

• Public Disclosure: ZKsync revealed the compromised wallet address and collaborated with SEAL Alliance to track funds.
• Patch Deployed: The sweepUnclaimed() function was patched and deactivated to prevent repeat abuse.
• User Assurance: Regular updates were posted on X to assure users that core contracts and wallets were unaffected.

Key Takeaways

• Multi-Signature Admin Accounts: A single compromised key shouldn’t lead to critical system access.
• Secure Key Management: Use hardware security modules (HSMs) or secure enclaves to protect sensitive credentials.
• Isolated Contract Functions: Critical operations like token minting must include strict permission checks and time locks.

KiloEx Exploit: Oracle Manipulation Attack

Overview

On April 14, 2025, KiloEx, a decentralized perpetual DEX backed by YZi Labs, was exploited for $7.5 million. The attack spanned multiple chains—Base, opBNB, and BNB Smart Chain—and stemmed from a critical price oracle vulnerability. The attacker manipulated asset prices to extract millions via leveraged positions.

https://crypto.news/kiloex-perpetual-dex-loses-7-4m-in-price-oracle-exploit/

Technical Breakdown

• Attack Vector: The root cause lay in KiloEx’s MinimalForwarder contract. The execute() function lacked proper authentication, allowing arbitrary signatures and spoofed calls to oracle update logic.
• Execution:
  1. The attacker used a spoofed signature to impersonate a trusted caller via MinimalForwarder.execute(), bypassing security checks.
  2. They set the ETH/USD price to $100, opened a large long position, then raised the price to $10,000, and closed the trade—profiting millions.
  3. This process was replicated across Base ($3.3M), opBNB ($3.1M), and BSC ($1M).

https://quillaudits.medium.com/kiloex-exploit-breakdown-7-4m-drained-across-chains-ff6e2293d5cb

• Cross-Chain Evasion: The attacker used zkBridge and Meson to obscure fund flows and move stolen assets, some in USDC (potentially subject to blacklisting by Circle).

Impact

• Total Loss: $7.5 million, primarily from LP funds.
• Token Market Cap: KILO fell 31.9% from $0.049 to $0.035, shrinking its market cap from $11 million to $7.5 million.
• Community Fallout: Users expressed frustration, particularly those who lost access to airdrop rewards. The attack also cast doubt on KiloEx's multi-chain architecture.

https://beincrypto.com/binance-backed-project-kiloex-hacked/

Response & Mitigation

• Platform Freeze: KiloEx suspended trading and smart contract interactions to prevent further losses.
• Bounty Strategy: A 10% white-hat bounty ($750K) was offered to the hacker, who ultimately returned the full $7.5 million within four days.

https://cryptonews.com/news/kiloex-hacker-returns-entire-7-5m-four-days-after-exploit/

• Collaboration: KiloEx worked with firms like Seal-911, SlowMist, and Sherlock, as well as network validators from BNB Chain and Manta Network, to trace stolen funds.

Key Takeaways

• Strict Access Controls: Permissionless execution functions should include robust signature verification and origin validation.
• Secure Oracle Design: Use decentralized or aggregated oracles with fail-safes like circuit breakers to prevent manipulation.
• Cross-Chain Oversight: Monitor bridge activity closely and implement alert systems for large or anomalous fund flows.

Broader Implications for DeFi Security

These incidents are part of a troubling trend. In Q1 2025 alone, DeFi exploits caused over $2 billion in losses, often due to a combination of centralized controls, flawed contract logic, and oracle vulnerabilities.

https://cointelegraph.com/news/zksync-hacker-steals-5m-airdrop-tokens

Recurring Risk Patterns

• Single Points of Failure: Whether an admin key (ZKsync) or oracle call (KiloEx), DeFi systems often hinge on weak links.
• Unchecked Execution: KiloEx’s unguarded execute() function echoes previous failures seen in Velocore and Uranium Finance.
• Cross-Chain Blind Spots: Bridges introduce latency and complexity that attackers exploit for laundering stolen funds.

Industry Trends

• White-Hat Incentives: KiloEx’s successful bounty echoes past cases like the October 2024 return of $6.1M to U.S. authorities.
• Regulatory Tension: U.S. lawmakers continue to scrutinize tools like Tornado Cash, citing their use in laundering funds.
• Audit Fatigue: Past audits alone no longer inspire confidence; continuous, real-time monitoring is now critical.

Recommendations

To strengthen DeFi defenses, protocols should:

1. Adopt Decentralized Governance: Use multi-sig or DAO-controlled mechanisms for contract upgrades and fund management.
2. Redesign Oracle Mechanisms: Incorporate redundancy, aggregation, and anomaly detection in price feed logic.
3. Enforce Contract Safeguards: Critical functions must have access control, validation layers, and emergency pause capabilities.
4. Implement Continuous Monitoring: Combine audits with on-chain analytics to detect suspicious activity early.
5. Promote Transparent Communication: Timely, clear updates build user trust—even amid crises.

Conclusion

The April 2025 exploits of ZKsync and KiloEx spotlight persistent weaknesses in DeFi infrastructure. From compromised admin keys to manipulable oracles, the attacks exploited gaps in design and oversight. While both platforms acted swiftly—ZKsync by patching contracts and KiloEx through fund recovery—the incidents reinforce the urgent need for stronger governance, smarter contract architecture, and real-time security monitoring. As the DeFi space matures, adopting these best practices will be essential for protecting users and sustaining innovation.

References

•KiloEx Offers Bounty as ZKsync Investigates Admin+Admin Breach - https://bitcoinethereumnews.com/tech/kiloex-offers-bounty-as-zksync-investigates-admin-breach/

•Hacker mints $5M in ZK tokens after compromising ZKsync admin account - https://cointelegraph.com/news/zksync-hacker-steals-5m-airdrop-tokens

•KiloEx perpetual DEX loses $7.4M in price oracle exploit - https://crypto.news/kiloex-perpetual-dex-loses-7-4m-in-price-oracle-exploit/

•Hackers Exploited $7.5 Million from KiloEx Vault DEX - https://nftevening.com/kiloex-vault-dex-hack/

•KiloEx Exploit Breakdown: $7.4M Drained Across Chains - https://quillaudits.medium.com/kiloex-exploit-breakdown-7-4m-drained-across-chains-ff6e2293d5cb

•KiloEx Warns Hacker After $7M Exploit, Offers 10% Bounty or Legal Action -https://cryptonews.com/news/kiloex-warns-hacker-after-7m-exploit-offers-10-bounty-or-legal-action/

•KiloEx Hacker Returns Entire $7.5M Four Days After Exploit - https://cryptonews.com/news/kiloex-hacker-returns-entire-7-5m-four-days-after-exploit/

•Mitosis Blog - https://blog.mitosis.org/

•Mitosis official website - https://mitosis.org/

•Mitosis university - https://university.mitosis.org/

•Mitosis expedition campaign - https://app.mitosis.org/?referral=T19Z2D&ref=university.mitosis.org