On July 9, 2025, ZKSwap's Ethereum Layer 1 bridge was exploited through its emergency withdrawal mechanism (Exodus Mode). The attacker exploited a critical flaw where the verifyExitProof() function failed to perform actual cryptographic verification of zero-knowledge proofs. By forging withdrawal proofs, the attacker artificially inflated their balance and withdrew approximately $5 million in assets.

ZKSwap’s Ethereum Layer 1 bridge suffered an exploit in which the attacker leveraged its emergency withdrawal mechanism, resulting in a loss of approximately $5 million. Analysis revealed that the component responsible for verifying zero-knowledge proofs had failed to actually perform the verification. This critical oversight allowed the attacker to forge arbitrary withdrawal proofs, effectively bypassing the bridge’s core security guarantees.