According to CoinCu, a single individual has orchestrated an elaborate Sybil attack on zkSync, controlling 21,877 wallets within the network. The attacker funded each wallet with small amounts of Ether and deployed a proprietary token named Gemstone (GEM), which was not open source. They then proceeded to whitelist all their wallets, claiming all self-deployed tokens in the process.
To facilitate transactions between these wallets, the individual created a non-open source decentralized exchange (DEX), allowing indirect transfers of assets. The attacker added liquidity with over 80 ETH to their own DEX contract to boost the value of GEM tokens. They then swapped GEM tokens claimed from the 21,877 wallets for a profit ranging from 0.6 to 0.7 Ether.
All transactions were automated and executed by a bot meticulously programmed by the attacker, allowing them to maintain control and avoid manual intervention. The attacker adjusted liquidity as needed, achieving a $10,000 volume and 10 transactions per wallet while only incurring fees ranging from $1.5 to $2 in Ether. They carefully timed transactions across different months, weeks, and days to resemble other Layer-2 projects' activities. Matter Labs, the team behind zkSync, is actively working to identify and mitigate the Sybil attack through GEM token claim contract detection.
