ZKasino Mystery Heist: $20M Bridged Ether Recovered, Renewing Hope for Victims

Over $20 million worth of bridged Ether has been returned to the wallet of the ZKasino blockchain-based gambling project, mysteriously—almost three weeks after users accused the platform's founders of an exit scam. On May 9, an X feed set up to recover funds from the ZKasino exit scam reported that almost $21 million worth of wstETH (wrapped Lido staking ETH) had returned to the project's multisignature wallet, leading some to believe that investors may soon be getting their funds back as originally promised.

One of the three scammers just sent the funds back to the original multi-sig wallet address, the $JAIL feed said, providing proof of the transfers with Etherscan. The 6,021 wstETH moved represents about two-thirds of what went missing in the heist, prompting the question, "Could they be preparing to refund the victims?"

ZKasino launched on April 20, offering an airdrop in its native token ZKAS to those who bridged ETH to the platform and promising to return the ETH. However, the gambling project moved around $33 million worth of users' bridged Ethereum to the staking protocol Lido Finance, instead of returning the funds to users as originally promised. This led to accusations of an exit scam or rug pull, as more than 10,000 people had bridged assets based on the protocol's pledges—a claim that was later broken.

On April 29, the Dutch authorities arrested a 26-year-old man suspected of involvement in the ZKasino scam. Authorities seized close to $12.2 million worth of cryptocurrencies, real estate, and luxury cars from the suspect. Some in the crypto community speculated that the arrested suspect might be the project founder, who used the pseudonym "Derivatives Monke," and had been doxxed as Elham Nourzai by blockchain sleuths.

On May 8, Cointelegraph reported that the Binance on-chain investigations team played a key role in leading law enforcement to the arrest of the suspect. Binance also assisted in freezing millions of dollars worth of stolen crypto after receiving a seizure warrant from authorities against the attacker's accounts.

Despite the arrest, illicit funds continue moving on-chain, indicating other potential attackers may remain at large. However, the latest movement of funds back to the project's multisig has renewed hope for some victims.

According to on-chain intelligence firm CertiK, excluding the ZKasino incident, April saw $25.7 million worth of cryptocurrencies lost to scams and hacks. This is the lowest historical figure since 2021, according to the firm, which began tracking the data that year.