{"id":20301,"date":"2025-04-01T12:51:53","date_gmt":"2025-04-01T12:51:53","guid":{"rendered":"https:\/\/nft.runfyers.com\/index.php\/2025\/04\/01\/phishing-twist-zklend-hacker-being-scammed-2930-eth\/"},"modified":"2025-04-01T12:51:53","modified_gmt":"2025-04-01T12:51:53","slug":"phishing-twist-zklend-hacker-being-scammed-2930-eth","status":"publish","type":"post","link":"https:\/\/nft.runfyers.com\/index.php\/2025\/04\/01\/phishing-twist-zklend-hacker-being-scammed-2930-eth\/","title":{"rendered":"Phishing Twist: zkLend Hacker Being Scammed 2,930 ETH"},"content":{"rendered":"<p><\/p>\n<div>\n<p><span style=\"font-weight: 400;\">The zkLend hacker just got reverse-hacked while laundering $5.4M in ETH through a Tornado Cash phishing scam. Then, he sent an on-chain message to a zkLend developer expressing remorse\u2014giving the community an early-month comedy show.<\/span><\/p>\n<h2><span class=\"ez-toc-section\" id=\"zkLend_Hacker_Wiped_Out_While_Laundering_2930_ETH_via_Tornado_Cash\"\/><b>zkLend Hacker Wiped Out While Laundering 2,930 ETH via Tornado Cash<\/b><span class=\"ez-toc-section-end\"\/><\/h2>\n<p><span style=\"font-weight: 400;\">The February attack on Starknet-based lending protocol <a href=\"https:\/\/zklend.com\/\" data-wpel-link=\"external\" target=\"_blank\" rel=\"nofollow external noopener noreferrer\">zkLend<\/a> resulted in a loss of approximately 3,666 ETH, valued at around $9.5 million. Recently, the hacker attempted to launder a portion of the stolen funds\u20142,930 ETH\u2014through Tornado Cash. Yesterday, the zkLend hacker executed multiple transfers, sending 100 Ether per transaction to an address labeled Tornado.Cash: Router, and concluded with three final deposits of 10 Ether each. He has mistakenly clicked on a phishing site impersonating the service, leading to the instant loss of all 2,930 ETH.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">In a desperate move, the hacker sent a \u201cheartfelt letter\u201d to zkLend, which was later <a href=\"https:\/\/etherscan.io\/\" data-wpel-link=\"external\" target=\"_blank\" rel=\"nofollow external noopener noreferrer\">leaked online<\/a>, turning the incident into a public spectacle and a source of ridicule across the crypto community.\u00a0<\/span><\/p>\n<div id=\"attachment_149983\" style=\"width: 1034px\" class=\"wp-caption alignnone\"><noscript><\/noscript><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-149983\" class=\"lazyload size-large wp-image-149983\" src=\"https:\/\/nftevening.com\/wp-content\/uploads\/2025\/04\/Screenshot-2025-04-01-132437-1024x408.png\" alt=\"zkLend Hacker Wiped Out While Laundering 2,930 ETH via Tornado Cash\" width=\"1024\" height=\"408\"\/><\/p>\n<p id=\"caption-attachment-149983\" class=\"wp-caption-text\">Source: Etherscan<\/p>\n<\/div>\n<h2><span class=\"ez-toc-section\" id=\"Inside_the_zkLend_Hack_for_96_million\"\/><b>Inside the zkLend Hack for $9.6 million<\/b><span class=\"ez-toc-section-end\"\/><\/h2>\n<p><span style=\"font-weight: 400;\">On February 12, 2025, zkLend, a decentralized lending protocol on the Starknet blockchain, suffered a major exploit, resulting in the theft of $9.48 million (3,666 ETH). The hacker exploited a decimal precision vulnerability in zkLend\u2019s smart contract, allowing them to drain funds from the protocol\u2019s pools.\u00a0<\/span><\/p>\n<div id=\"attachment_149984\" style=\"width: 1034px\" class=\"wp-caption alignnone\"><noscript><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-149984\" class=\"size-large wp-image-149984\" src=\"https:\/\/nftevening.com\/wp-content\/uploads\/2025\/04\/zklend-1024x576.jpg\" alt=\"Inside the zkLend Hack for $9.6 million\" width=\"1024\" height=\"576\"\/><\/noscript><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-149984\" class=\"lazyload size-large wp-image-149984\" src=\"https:\/\/nftevening.com\/wp-content\/uploads\/2025\/04\/zklend-1024x576.jpg\" alt=\"Inside the zkLend Hack for $9.6 million\" width=\"1024\" height=\"576\"\/><\/p>\n<p id=\"caption-attachment-149984\" class=\"wp-caption-text\">Source: LinkedIn<\/p>\n<\/div>\n<p>The hacker first bridged the stolen assets to <a href=\"https:\/\/nftevening.com\/what-is-ethereum\/\" data-wpel-link=\"internal\" target=\"_blank\" rel=\"noopener\">Ethereum<\/a>. He then funneled them through the privacy protocol Railgun. However, Railgun\u2019s policies forced him to return the funds to his original address. The breach sparked serious concerns about DeFi security. It contributed to the $1.64 billion in crypto losses in Q1 2025. zkLend\u2019s hack ranked as the fifth-largest exploit of the quarter.<\/p>\n<p><span style=\"font-weight: 400;\">In response, zkLend paused withdrawals and deposits to mitigate further losses and launched an investigation into the contract logic flaw. The protocol offered the hacker a 10% \u201cwhite hat\u201d bounty (3,300 ETH) to return the remaining funds. On March 5, zkLend opened a Recovery Portal, enabling users to claim losses\u2014full refunds for unaffected pools and partial refunds with recovery pool claims for affected ones\u2014while working to rebuild trust in the platform.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">zkLend is a decentralized money-market protocol on Starknet, combining zk-rollup scalability with Ethereum\u2019s security. It enables users to deposit, borrow, and lend assets efficiently in a trustless environment. Launched to enhance DeFi accessibility, zkLend offers superior transaction speed and cost savings, making it a promising player in the lending space.<\/span><\/p>\n<\/div>\n<p><a href=\"https:\/\/nftevening.com\/phishing-twist-zklend-hacker-being-scammed\/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=phishing-twist-zklend-hacker-being-scammed\" target=\"_blank\" rel=\"noopener\">Source link <\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The zkLend hacker just got reverse-hacked while laundering $5.4M in ETH through a Tornado Cash phishing scam. Then, he sent an on-chain message to a zkLend developer expressing remorse\u2014giving the community an early-month comedy show. zkLend Hacker Wiped Out While Laundering 2,930 ETH via Tornado Cash The February attack on Starknet-based lending protocol zkLend resulted [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":20302,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true},"categories":[9],"tags":[21],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/nftevening.com\/wp-content\/uploads\/2025\/04\/Featured-Image-1280x720-PRPartnered-63.jpg","jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/nft.runfyers.com\/index.php\/wp-json\/wp\/v2\/posts\/20301"}],"collection":[{"href":"https:\/\/nft.runfyers.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nft.runfyers.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nft.runfyers.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nft.runfyers.com\/index.php\/wp-json\/wp\/v2\/comments?post=20301"}],"version-history":[{"count":0,"href":"https:\/\/nft.runfyers.com\/index.php\/wp-json\/wp\/v2\/posts\/20301\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nft.runfyers.com\/index.php\/wp-json\/wp\/v2\/media\/20302"}],"wp:attachment":[{"href":"https:\/\/nft.runfyers.com\/index.php\/wp-json\/wp\/v2\/media?parent=20301"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nft.runfyers.com\/index.php\/wp-json\/wp\/v2\/categories?post=20301"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nft.runfyers.com\/index.php\/wp-json\/wp\/v2\/tags?post=20301"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}