{"investigation":{"slug":"zklend","entity_name":"zkLend","trust_score":20,"severity_base":null,"score_modifier":0,"confidence":0.88,"status":"published","content_type":"investigation","summary":"zkLend was a decentralized money-market lending protocol built on Starknet (Ethereum Layer 2), founded in 2022 by Brian Fu and Jane Ma and backed by Delphi Digital, Three Arrows Capital, and StarkWare. On February 11–12, 2025, the protocol suffered a critical flash-loan exploit that drained approximately $9.57 million in user funds through manipulation of the lending_accumulator variable and precision-loss rounding errors. The protocol permanently ceased operations in June 2025, allocating a $200,000 treasury remnant to a user recovery fund — leaving the vast majority of affected users uncompensated.","sections":[{"content":"zkLend was a non-custodial, decentralized money-market protocol operating on Starknet, a zero-knowledge rollup Layer 2 scaling solution for Ethereum. Founded in February 2022 by Brian Fu and Jane Ma, the protocol offered two distinct environments: Artemis, a permissionless lending market for retail DeFi users, and Apollo, a permissioned institutional environment. zkLend officially launched on Starknet mainnet on October 19, 2023. The protocol's native token, ZEND, was listed on major exchanges including Bybit and KuCoin. Brian Fu brought over 15 years of traditional finance experience from Bloomberg and Standard Chartered Bank; Jane Ma previously worked in Sales and Trading at Credit Suisse and as Chief of Staff at Deliveroo Hong Kong.","heading":"Protocol Overview","sources":[{"url":"https://www.globenewswire.com/news-release/2022/03/29/2412153/0/en/StarkNet-money-market-zkLend-raises-5M-in-seed-round-led-by-Delphi-Digital.html","name":"globenewswire.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2022/03/29/delphi-digital-leads-5m-seed-round-for-money-market-protocol-zklend","name":"coindesk.com","type":"other","credibility":3},{"url":"https://mirror.xyz/decentdao.eth/YlGq-m2b2r_mHaebYCiksOpnA1zA19CIWZCr_o_T8zs","name":"mirror.xyz","type":"other","credibility":3}],"severity":"medium"},{"content":"In March 2022, zkLend raised $5 million in a seed round led by Delphi Digital (Delphi Ventures), with participation from Three Arrows Capital (3AC), StarkWare, Alameda Research, Genesis Block Ventures, CMS Holdings, Amber Group, MetaCartel DAO, and others. The involvement of Three Arrows Capital is notable given that 3AC subsequently collapsed in June 2022 following the Terra/LUNA crash, becoming one of the largest failures in crypto history. The participation of Alameda Research — the trading firm associated with FTX that also collapsed in November 2022 amid fraud — further clouds the project's early investor roster, though no direct causal link between these investor failures and zkLend's operations has been established.","heading":"Funding and Notable Investors","sources":[{"url":"https://cointelegraph.com/press-releases/money-market-zklend-raises-5m-in-seed-round-led-by-delphi-digital","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2022/03/29/delphi-digital-leads-5m-seed-round-for-money-market-protocol-zklend","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.globenewswire.com/news-release/2022/03/29/2412153/0/en/StarkNet-money-market-zkLend-raises-5M-in-seed-round-led-by-Delphi-Digital.html","name":"globenewswire.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On February 11–12, 2025, zkLend was exploited for approximately $9.57 million in a sophisticated flash-loan attack targeting the wstETH market. The stolen assets comprised 2,213.64 ETH, 1,553,069.49 USDC, 7,426,029.99 STRK, and 518,225.71 USDT.\n\nThe root cause was a combination of three individually-tolerated design choices that became critically exploitable in combination: (1) empty market initialization that allowed arbitrary deposits into a zero-reserve pool, (2) a flash loan 'donation' mechanism that updated the global lending_accumulator variable based on excess repayments, and (3) floor-division rounding in withdrawal calculations that caused systematic underestimation of balance changes.\n\nThe attacker deposited 1 wei of wstETH, then executed a series of flash loans — borrowing 1 wei and repaying approximately 1,000 wei each time — to inflate the lending_accumulator to roughly 4.069 × 10^18 (approximately 4 billion times its baseline value). This massively amplified the attacker's recorded collateral: starting from a trivial deposit, the attacker effectively booked 7,015.4 wstETH worth of collateral and used it to borrow and drain other assets from the protocol. The attacker then bridged the stolen funds to Ethereum Layer 1 via LayerSwap, Orbiter Bridge, Rhino.fi, and the StarkGate ETH Bridge.\n\nAttacker addresses on Ethereum include: 0x645c77833833a6654f7edaa977ebeabc680a9109, 0x0b7d061d91018aab823a755020e625ffe8b93074, 0xcd1c290198E12c4c1809271e683572FBF977Bb63, and 0x069E70C39A6495D31f518AE2F3c1166ddEfa5cAF.\n\nDespite two smart contract audits by Nethermind (May 2022 and September 2023) that reportedly identified no critical issues, this rounding-error vulnerability went undetected. The exploit is technically similar to the EraLend reentrancy hack of July 2023.","heading":"February 2025 Exploit — Critical Security Incident","sources":[{"url":"https://medium.com/zklend/zklend-security-incident-post-mortem-27d9abaf66f6","name":"medium.com","type":"other","credibility":3},{"url":"https://blocksec.com/blog/zklend-exploit-post-mortem-unraveling-the-details-and-clarifying-misunderstandings-of-the-10m-flash-loan-attack","name":"blocksec.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-zklend-hack-february-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://rekt.news/zklend-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/zklend-starknet-hack-4-9m-bounty","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://cryptoslate.com/zklend-hack-sees-9-5m-exploit-offers-hacker-10-bounty-for-return/","name":"cryptoslate.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Blockchain security firm SlowMist published an in-depth analysis alleging that the zkLend attacker is the same individual or group responsible for the EraLend exploit of July 25, 2023, which caused approximately $2.76 million in losses. According to SlowMist, the attacker used their Starknet address to test transactions with three Layer 1 Ethereum addresses before executing the zkLend exploit; two of those L1 addresses had previously received funds from the EraLend attack. This alleged link to a prior exploit suggests a sophisticated, repeat threat actor rather than an opportunistic attacker. No public identification of the attacker by name has been confirmed by law enforcement.","heading":"Attacker Attribution — Alleged Link to EraLend Hack","sources":[{"url":"https://slowmist.medium.com/in-depth-analysis-of-zklend-hack-linked-to-eralend-hack-fba4af9b66ef","name":"slowmist.medium.com","type":"other","credibility":3},{"url":"https://bitcoinethereumnews.com/tech/starknets-zklend-hacked-by-same-attacker-as-eralend-reveals-slowmists-chandler-guo/","name":"bitcoinethereumnews.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, the attacker attempted to launder stolen funds through Railgun, an Ethereum-based privacy protocol. Railgun's internal compliance policies rejected the transaction and returned the funds to the attacker's originating address. Subsequently, on or around March 31, 2025, the attacker attempted to use Tornado Cash to launder approximately 2,930 ETH (worth roughly $5.4 million at the time). The attacker unknowingly used a phishing site — tornadoeth.cash — that impersonated Tornado Cash's frontend. The attacker posted an on-chain message to zkLend via Etherscan stating: 'I tried to move funds to tornado but I used a phishing website and all the funds have been lost. All the 2930 eth have been taken by that site owners.' The remaining portion of stolen funds (estimated at several million dollars) remained at the attacker's known Ethereum addresses as of the time of reporting.","heading":"Post-Exploit Fund Movements and Laundering Attempts","sources":[{"url":"https://cointelegraph.com/news/zk-lend-hacker-loses-stolen-eth-after-depositing-it-into-a-tornado-cash-phishing-site","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2025/04/03/zklend-hacker-loses-5-4m-in-phishing-attack-while-using-tornado-cash/","name":"cryptotimes.io","type":"other","credibility":3},{"url":"https://cryptoslate.com/hacker-falls-victim-to-phishing-scam-after-exploiting-zklend-for-millions/","name":"cryptoslate.com","type":"other","credibility":3},{"url":"https://www.cryptopolitan.com/zklend-hacker-loses-funds-phishing/","name":"cryptopolitan.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Immediately following the exploit, zkLend suspended all withdrawals and launched an investigation. Within six hours of the exploit, the team offered the attacker a 10% white hat bounty — equivalent to approximately 3,300 ETH — in exchange for return of the remaining funds, setting a deadline of February 14, 2025. The attacker did not respond and the deadline passed without any return of funds.\n\nOn approximately March 5, 2025, zkLend opened a Recovery Portal allowing affected users to register claims. The compensation plan distinguished between users in unaffected pools (full refund) and users in affected pools (partial compensation via a recovery NFT). The team estimated the total funding gap at approximately $9,013,101.72. Approximately 82,818 NFTs were to be distributed to affected users, each representing a pro-rata claim. The team contributed approximately $400,000 toward the recovery fund by forfeiting protocol revenue and treasury deposit claims.","heading":"Protocol Response and Compensation Plan","sources":[{"url":"https://medium.com/zklend/zklend-compensation-plan-5682dcf91f57","name":"medium.com","type":"other","credibility":3},{"url":"https://crypto.news/zklend-opens-recovery-portal-for-zklend-exploit-2025/","name":"crypto.news","type":"other","credibility":3},{"url":"https://cryptonews.com/news/zklend-launches-recovery-portal-for-victims-of-the-drained-9-6-million/","name":"cryptonews.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In June 2025 — approximately four months after the exploit — zkLend announced the permanent cessation of all operations. The team cited deep erosion of user confidence following the hack, compounded by the delisting of the ZEND token from major exchanges including Bybit and KuCoin, which severely constrained token liquidity and precluded any viable relaunch. The team allocated its remaining approximately $200,000 treasury to the user recovery fund and committed to open-sourcing its audited codebase for any interested parties to continue development. The team stated it would continue collaborating with zeroShadow (a blockchain forensics firm) to pursue recovery of stolen funds, with any recovered assets to be redirected to the user recovery fund. A $500,000 bounty for information leading to the attacker's capture was reportedly maintained.","heading":"Protocol Shutdown (June 2025)","sources":[{"url":"https://crypto.news/starknet-based-l2-protocol-zklend-shuts-down/","name":"crypto.news","type":"other","credibility":3},{"url":"https://cryptobriefing.com/zklend-shutdown-zend-delisting/","name":"cryptobriefing.com","type":"other","credibility":3},{"url":"https://cryptonews.com/news/zklend-shuts-down-200k-recovery-fund-users/","name":"cryptonews.com","type":"other","credibility":3},{"url":"https://www.ainvest.com/news/zklend-shuts-9-5-million-exploit-allocates-200-000-recovery-fund-2506/","name":"ainvest.com","type":"other","credibility":3}],"severity":"medium"},{"content":"zkLend underwent at least two smart contract audits by Nethermind Security — one in May 2022 and one in September 2023 — neither of which reportedly identified the critical rounding-error vulnerability that was ultimately exploited. A public audit report (NM0161-FINAL_ZKLEND_ZKTOKEN.pdf) is available in Nethermind's public GitHub repository. The failure to detect the accumulator manipulation vector across two independent audits has drawn attention from the DeFi security community and been cited as a cautionary example of how individually non-critical design choices can combine into exploitable attack surfaces. Security firm Halborn and BlockSec each published post-mortem analyses documenting the root cause.","heading":"Audit History and Security Failures","sources":[{"url":"https://github.com/NethermindEth/PublicAuditReports","name":"github.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-zklend-hack-february-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://blocksec.com/blog/zklend-exploit-post-mortem-unraveling-the-details-and-clarifying-misunderstandings-of-the-10m-flash-loan-attack","name":"blocksec.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2022-02","event":"zkLend founded by Brian Fu and Jane Ma","source":"","date_original":"2022-02-01"},{"date":"2022-03-29","event":"zkLend raises $5 million seed round led by Delphi Digital, with Three Arrows Capital, StarkWare, Alameda Research, and others participating","source":""},{"date":"2022-07","event":"zkLend testnet opens","source":"","date_original":"2022-07-01"},{"date":"2023-07-25","event":"EraLend hack occurs (~$2.76 million loss); SlowMist later alleges the same attacker is responsible for the subsequent zkLend exploit","source":""},{"date":"2023-10-19","event":"zkLend officially launches on Starknet mainnet with Artemis and Apollo environments","source":""},{"date":"2025-02-11","event":"zkLend exploit begins; attacker manipulates wstETH market lending_accumulator via flash loans and rounding errors, draining approximately $9.57 million in ETH, USDC, STRK, and USDT","source":""},{"date":"2025-02-12","event":"zkLend suspends all withdrawals; publicly discloses exploit and offers 10% white hat bounty (~3,300 ETH) with February 14 deadline","source":""},{"date":"2025-02-14","event":"Attacker ignores white hat bounty deadline; funds not returned","source":""},{"date":"2025-02-14","event":"Stolen funds bridged to Ethereum; attacker attempts Railgun laundering — rejected by Railgun compliance policies, funds returned to attacker address","source":""},{"date":"2025-03-05","event":"zkLend opens Recovery Portal for affected users; compensation plan announced including ~82,818 recovery NFTs","source":""},{"date":"2025-03-31","event":"Attacker posts on-chain message to zkLend admitting to losing 2,930 ETH (~$5.4 million) to a fake Tornado Cash phishing site (tornadoeth.cash) while attempting to launder funds","source":""},{"date":"2025-06-25","event":"zkLend announces permanent shutdown of operations; cites hack fallout and ZEND token delistings from Bybit and KuCoin; allocates remaining $200,000 treasury to user recovery fund","source":""}],"sources_used":[{"url":"https://www.globenewswire.com/news-release/2022/03/29/2412153/0/en/StarkNet-money-market-zkLend-raises-5M-in-seed-round-led-by-Delphi-Digital.html","name":"globenewswire.com","type":"other","archive_url":"http://web.archive.org/web/20260802124442/https://www.globenewswire.com/news-release/2022/03/29/2412153/0/en/starknet-money-market-zklend-raises-5m-in-seed-round-led-by-delphi-digital.html","credibility":3,"archive_timestamp":"2026-08-02T12:44:42+00:00"},{"url":"https://www.coindesk.com/business/2022/03/29/delphi-digital-leads-5m-seed-round-for-money-market-protocol-zklend","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20251205132853/https://www.coindesk.com/business/2022/03/29/delphi-digital-leads-5m-seed-round-for-money-market-protocol-zklend","credibility":3,"archive_timestamp":"2025-12-05T13:28:53+00:00"},{"url":"https://mirror.xyz/decentdao.eth/YlGq-m2b2r_mHaebYCiksOpnA1zA19CIWZCr_o_T8zs","name":"mirror.xyz","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cointelegraph.com/press-releases/money-market-zklend-raises-5m-in-seed-round-led-by-delphi-digital","name":"cointelegraph.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://medium.com/zklend/zklend-security-incident-post-mortem-27d9abaf66f6","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://blocksec.com/blog/zklend-exploit-post-mortem-unraveling-the-details-and-clarifying-misunderstandings-of-the-10m-flash-loan-attack","name":"blocksec.com","type":"other","archive_url":"http://web.archive.org/web/20260415194735/https://blocksec.com/blog/zklend-exploit-post-mortem-unraveling-the-details-and-clarifying-misunderstandings-of-the-10m-flash-loan-attack","credibility":3,"archive_timestamp":"2026-04-15T19:47:35+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-zklend-hack-february-2025","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260207111622/https://www.halborn.com/blog/post/explained-the-zklend-hack-february-2025","credibility":3,"archive_timestamp":"2026-02-07T11:16:22+00:00"},{"url":"https://rekt.news/zklend-rekt","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260518010231/https://rekt.news/zklend-rekt","credibility":3,"archive_timestamp":"2026-05-18T01:02:31+00:00"},{"url":"https://cointelegraph.com/news/zklend-starknet-hack-4-9m-bounty","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20250917185951/https://cointelegraph.com/news/zklend-starknet-hack-4-9m-bounty","credibility":3,"archive_timestamp":"2025-09-17T18:59:51+00:00"},{"url":"https://cryptoslate.com/zklend-hack-sees-9-5m-exploit-offers-hacker-10-bounty-for-return/","name":"cryptoslate.com","type":"other","archive_url":"https://web.archive.org/web/20260829075153/https://cryptoslate.com/zklend-hack-sees-9-5m-exploit-offers-hacker-10-bounty-for-return/","credibility":3,"archive_timestamp":"2026-08-29T07:51:53+00:00"},{"url":"https://slowmist.medium.com/in-depth-analysis-of-zklend-hack-linked-to-eralend-hack-fba4af9b66ef","name":"slowmist.medium.com","type":"other","archive_url":"http://web.archive.org/web/20250906080046/https://slowmist.medium.com/in-depth-analysis-of-zklend-hack-linked-to-eralend-hack-fba4af9b66ef","credibility":3,"archive_timestamp":"2025-09-06T08:00:46+00:00"},{"url":"https://bitcoinethereumnews.com/tech/starknets-zklend-hacked-by-same-attacker-as-eralend-reveals-slowmists-chandler-guo/","name":"bitcoinethereumnews.com","type":"other","archive_url":"http://web.archive.org/web/20260829024239/https://bitcoinethereumnews.com/tech/starknets-zklend-hacked-by-same-attacker-as-eralend-reveals-slowmists-chandler-guo/","credibility":3,"archive_timestamp":"2026-08-29T02:42:39+00:00"},{"url":"https://cointelegraph.com/news/zk-lend-hacker-loses-stolen-eth-after-depositing-it-into-a-tornado-cash-phishing-site","name":"cointelegraph.com","type":"other","archive_url":"https://web.archive.org/web/20260830071748/https://cointelegraph.com/news/zk-lend-hacker-loses-stolen-eth-after-depositing-it-into-a-tornado-cash-phishing-site","credibility":3,"archive_timestamp":"2026-08-30T07:17:48+00:00"},{"url":"https://www.cryptotimes.io/2025/04/03/zklend-hacker-loses-5-4m-in-phishing-attack-while-using-tornado-cash/","name":"cryptotimes.io","type":"other","archive_url":"http://web.archive.org/web/20260802124319/https://www.cryptotimes.io/2025/04/03/zklend-hacker-loses-5-4m-in-phishing-attack-while-using-tornado-cash/","credibility":3,"archive_timestamp":"2026-08-02T12:43:19+00:00"},{"url":"https://cryptoslate.com/hacker-falls-victim-to-phishing-scam-after-exploiting-zklend-for-millions/","name":"cryptoslate.com","type":"other","archive_url":"http://web.archive.org/web/20250911221331/https://cryptoslate.com/hacker-falls-victim-to-phishing-scam-after-exploiting-zklend-for-millions/","credibility":3,"archive_timestamp":"2025-09-11T22:13:31+00:00"},{"url":"https://www.cryptopolitan.com/zklend-hacker-loses-funds-phishing/","name":"cryptopolitan.com","type":"other","archive_url":"http://web.archive.org/web/20260117011032/https://www.cryptopolitan.com/zklend-hacker-loses-funds-phishing/","credibility":3,"archive_timestamp":"2026-01-17T01:10:32+00:00"},{"url":"https://medium.com/zklend/zklend-compensation-plan-5682dcf91f57","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://crypto.news/zklend-opens-recovery-portal-for-zklend-exploit-2025/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20251207134036/https://crypto.news/zklend-opens-recovery-portal-for-zklend-exploit-2025/","credibility":3,"archive_timestamp":"2025-12-07T13:40:36+00:00"},{"url":"https://cryptonews.com/news/zklend-launches-recovery-portal-for-victims-of-the-drained-9-6-million/","name":"cryptonews.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://crypto.news/starknet-based-l2-protocol-zklend-shuts-down/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20251010035007/https://crypto.news/starknet-based-l2-protocol-zklend-shuts-down/","credibility":3,"archive_timestamp":"2025-10-10T03:50:07+00:00"},{"url":"https://cryptobriefing.com/zklend-shutdown-zend-delisting/","name":"cryptobriefing.com","type":"other","archive_url":"http://web.archive.org/web/20260115145529/https://cryptobriefing.com/zklend-shutdown-zend-delisting/","credibility":3,"archive_timestamp":"2026-01-15T14:55:29+00:00"},{"url":"https://cryptonews.com/news/zklend-shuts-down-200k-recovery-fund-users/","name":"cryptonews.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.ainvest.com/news/zklend-shuts-9-5-million-exploit-allocates-200-000-recovery-fund-2506/","name":"ainvest.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://github.com/NethermindEth/PublicAuditReports","name":"github.com","type":"other","archive_url":"http://web.archive.org/web/20260305113645/https://github.com/NethermindEth/PublicAuditReports","credibility":3,"archive_timestamp":"2026-03-05T11:36:45+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:25.639063+00:00","updated_at":"2026-09-01T03:39:50.083355+00:00"}}