ZkLend Hack Results in $9.5 Million Exploit, Hackers Offered Bounty
By: Isha Das
ZkLend, an emerging decentralized finance (DeFi) lending protocol built on Starknet, has recently fallen victim to a significant security breach, resulting in the loss of approximately $9.5 million. This alarming incident underscores the vulnerability of blockchain platforms to sophisticated cyber threats. Despite the platform not specifying the exact amount stolen, blockchain security firm Cyvers has estimated the financial damage to be in the realm of $9.5 million following their investigation into the hack.
In an attempt to recover the majority of the stolen assets, ZkLend made an unusual public offer via a post on X (formerly known as Twitter), appealing directly to the hacker. They proposed a 10% retention of the funds as a whitehat bounty if the attacker returned the remaining 90%, specifically 3,300 ETH, back to a designated Ethereum address. The platform notified the perpetrator that no legal repercussions would be pursued if the funds were returned by the deadline of February 14, 2025. However, they remain resolute in their decision to employ legal strategies and asset tracking if the conditions are not met.
To ensure transparency and authenticity, ZkLend confirmed the legitimacy of their offer via their Ethereum ZEND token deployer account and encouraged public verification through their official account on X. In light of the exploit, the platform has halted withdrawals and cautioned users against deposits or loan repayments until further notice. ZkLend is actively working alongside blockchain security professionals and law enforcement to conduct a thorough investigation. Upon its conclusion, the team has promised a detailed report on the incident, as well as the implementation of enhanced security measures.
In the wake of the breach, Cyvers reported that the stolen Ethereum was initially bridged to the Ethereum network and subsequently routed through Railgun, a privacy-focused transaction service. Interestingly, due to Railgun’s operational policies, the funds reverted to their origin. This breach at ZkLend marks yet another instance in an ongoing series of security compromises involving cryptocurrencies. According to data from DeFiLlama, the first months of 2025 alone have seen over $100 million in digital assets siphoned off by cybercriminals. This adds to the previous year's staggering $2.2 billion in losses from over 300 recorded incidents. As these attacks become more prevalent, experts caution that the industry must brace for further potential financial setbacks.
