April 16 (Cointime) -  zkSync announced it had regained access to its account after about 12 hours of attack, along with a yellow tick. 

"In this instance, an impersonator fabricated their identity and claimed to be an official zkSync representative while contacting Twitter support.  Unfortunately, a support agent did not follow the standard procedure and approved the request to change our email and password." the project explained in a tweet.

Despite the attacker being unable to gain access due to enabled 2FA, zkSync's team was logged out and lost access since the password was changed. 

Read full thread:

High-profile accounts like @zksync are frequently targeted, and @Twitter is working tirelessly to ensure the safety of the users. In this instance, an impersonator fabricated their identity and claimed to be an official zkSync representative while contacting Twitter support. 2/

Unfortunately, a support agent did not follow the standard procedure and approved the request to change our email and password. It is important to remember that everyone can make mistakes, regardless of their position or industry. 3/

zkSync is committed to a security-first approach. This philosophy extends to the Web2 services including Twitter. We employ stringent security measures, such as frequently changing strong passwords, enabling 2FA, and limiting account access to a select few individuals. 4/

Due to the enabled 2FA, the attacker was unable to gain access to our account. However, since the password was changed, our team was logged out and lost access. We quickly noticed this, contacted @TwitterSupport, and initiated an investigation. 5/

We utilize an external tool for managing our tweets. Despite losing access to our account, this tool remained connected, allowing us to post a brief “gm”. 6/

Using the API key from the external tool, we determined that the email associated with our account had been changed to a fraudulent domain impersonating zkSync. 7/

As our server did not receive any notifications regarding an email change, it became clear that the compromise had not originated from our side. Consequently, we decided to issue a warning to our community. 8/

@TwitterSupport responded promptly, securing our account and working closely with us to resolve the issue. 9/

To further boost security, Twitter expedited our application for the golden "Verified" badge which will help a lot against scammers. All official affiliated accounts now have a little @zksync sign next to their name. 10/

Once the new setup was complete, we shared an update with the community. 11/

In conclusion, enabling 2FA and adhering to other security best practices are essential, but the core issue lies in the centralization of protocols which brings single points of failure. 12/

We envision a future where more applications and everyday use cases are built on decentralized protocols, including social media platforms that offer enhanced security and true ownership of data, accounts, and content. 13/

This vision drives our work on @zksync, which will enable a trustless, permissionless, and decentralized Internet where users can rely on math and open source rather than trusting institutions or individuals. Stay safe, fam! 14/14