Zipcoin Announces Shutdown and Plans Token Sale

Zipcoin said Thursday it is shutting down and plans to sell its remaining project-held ZC tokens, which it put at 2.2% of supply, after a reported compromise of its codebase and private keys.

In its closure announcement, the Ethereum-based privacy project promised holders a six-hour window to sell before it liquidates its own holdings. It said it would consolidate the proceeds from associated wallets “before the attacker can potentially drain them.” The post did not specify a distribution of proceeds to holders.

The sale deadline is ambiguous. The post specifies “12:00 EST,” equivalent to 1 p.m. ET on Oct. 22 while daylight saving time is in effect, but does not clarify whether it meant noon local time.

ZC plunged 84.2% over the preceding 24 hours, with a circulating market capitalization of about $370,000, according to CoinGecko data updated at 8:09 a.m. ET.

Thursday morning, Etherscan showed the address labeled “Zip Coin: Deployer” holding 16.98 million ZC, or 1.6976% of the token's maximum supply. A transaction at 6:55 a.m. ET transferred 0.1096 wrapped $ETH from that address to a wallet beginning 0x7d942. The announcement did not identify all wallets behind the team's 2.2% figure.

Zipcoin said Railway alerted it on Oct. 21 that its entire codebase, including secrets and private keys controlling project wallets and infrastructure, had been compromised. It said attempts to migrate or rotate credentials had failed to produce a viable way to continue operating.

Railway's own disclosure, published Oct. 21, described possible unauthorized access to encrypted customer environment variables and the decrypted contents of some of them. These settings can contain credentials such as API keys. Railway urged all users to rotate environment variables and private registry credentials. Its notice did not identify Zipcoin or confirm the theft of its entire codebase.

UNCX Losses Preceded the Key Exposure

The shutdown follows losses in UNCX's Smart Token Vesting V2 system, which pools tokens and uses internal shares to track vesting positions. According to UNCX's incident report, attackers manipulated that accounting on Oct. 14 so their positions could withdraw more tokens than they had supplied, drawing assets allocated to other positions.

UNCX reported net outflows of about 10.93 million ZC, after subtracting attacker-supplied tokens. The affected Ethereum assets also included EDGEN, PEPECOIN, LO0P, PAAL and X.

Onchain records show a contract used in the exploit transferred 9.06 million ZC to the address Etherscan labels “Unicrypt Exploiter 1” on Oct. 15. A subsequent sale transaction routed those tokens through trading pools and returned about 6.52 $ETH to that address.

Zipcoin said it had kept its UNCX losses quiet and purchased tokens on the open market to replace tokens intended for future team commitments.