Starknet’s zkLend loses over $8m in hack, demands return

zkLend has lost over $9 million worth of Ethereum in a hack. The protocol is demanding the hacker return 90% of the stolen funds or face legal consequences.

On Feb. 12, Starknet-based layer2 money-market protocol zkLend officially admitted that it had been hacked. The protocol said their internal team is currently investigating the root cause of the exploit. In the meantime, all withdrawals on the protocol have been paused until further notice. The hack resulted in a loss of more than $9 million worth of Ethereum (ETH).

In a recent post addressed to the hacker, whose identity remains unknown, zkLend stated that it will allow the hacker to keep 10% of the stolen funds as a “whitehat bounty”. However, the protocol asked the hacker to return 90% of the stolen funds, which is equal to 3,300 ETH or $8.6 million according to current market prices.

“We are working with security firms and law enforcement at this stage. If we do not hear from you by 00:00 UTC, 14th Feb 2025, we will proceed with the next steps to track and prosecute you.” said zkLend.

To the hacker:

We understand that you are responsible for today’s attack on zkLend. You may keep 10% of the funds as a whitehat bounty, and send back the remaining 90%, or 3,300 ETH to be exact, to this Ethereum address: 0xCf31e1b97790afD681723fA1398c5eAd9f69B98C.

Upon… pic.twitter.com/piEVPDHZd4

— zkLend (@zkLend) February 12, 2025

You might also like: Starknet announces STRK staking v2 set for Q2

Once 90% of the funds have been returned, the Starknet (STRK)-based protocol has agreed to release the hacker from all charges regarding the attack. If the hacker fails to respond by the deadline, the protocol claimed it will take legal action to “track and prosecute” the perpetrator.

In a separate post, the protocol said it was actively tracking the funds and working to identify the hacker by collaborating with other entities, including the Starknet Foundation, StarkWare, Zero Shadow, Binance Security Team and Hypernative Labs.

Earlier today, CertiK Alert detected multiple attack transactions occurring on the zkLend market. The account claimed the attacker stole at least $5 million and bridged them to Ethereum through a specified address.

According to data from DeFi Llama, zkLend has a total value locked amounting to $1.19 million, with around $14.6 million in borrowed funds on Starknet Layer2.

You might also like: Starknet makes history as first L2 to introduce staking on mainnet

Source