Skip to main content
AVOID.NET
Sign in

zkLend (Starknet)

avoid.net/zklend-starknet→4/100·88% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·4LUVCV…NgPo

Summary

zkLend was a decentralized money-market lending protocol built on the Starknet L2 network. On February 12, 2025, the protocol suffered a critical exploit caused by a decimal precision vulnerability in its lending_accumulator mechanism, resulting in approximately $9.57 million in user funds being drained. The protocol subsequently shut down in June 2025, returning only a nominal $200,000 treasury to affected users.

Connected Entities

1 entities
Organizations
□zkLend (Starknet)
Relationships
    Have evidence about zkLend (Starknet)?

    Timeline(10 events)

    29 March 2022

    zkLend raises $5 million seed round led by Delphi Digital, with participation from Three Arrows Capital, Alameda Research, StarkWare, and others.

    GlobeNewswire

    25 July 2023

    EraLend, a lending protocol on zkSync, is exploited for approximately $3.4 million via a read-only reentrancy vulnerability. On-chain forensics would later link attacker addresses to the subsequent zkLend hack.

    Halborn Security

    October 2023

    zkLend's Cairo 1 smart contracts are audited by Nethermind and deployed on Starknet ahead of Starknet Regenesis.

    zkLend Documentation

    12 February 2025

    Attacker exploits the lending_accumulator decimal precision vulnerability, draining approximately $9.57 million (including 2,930+ ETH, USDC, USDT, STRK) from zkLend's liquidity pools on Starknet.

    Rekt News

    12 February 2025

    zkLend issues on-chain and public bounty offer: 10% white-hat reward (~3,300 ETH) with February 14 midnight UTC deadline in exchange for return of remaining funds and promise of no legal action.

    CoinTelegraph

    12 February 2025

    Attacker attempts to launder 706.4 WETH through Railgun privacy protocol. Railgun's exclusion policies automatically return the funds to the originating address.

    Rekt News

    14 February 2025

    Bounty deadline passes with no response or fund return from the attacker. zkLend states it will pursue legal action and engage forensics firm zeroShadow.

    CoinTelegraph

    5 March 2025

    zkLend opens a recovery portal for affected users, outlining partial compensation for deposits in affected pools and full compensation for unaffected pool deposits.

    Crypto.news

    April 2025

    The zkLend attacker loses 2,930 ETH (approximately $5.4 million) by depositing stolen funds into a fake Tornado Cash phishing website. The attacker sends an on-chain message to zkLend's deployer address: 'I tried to move funds to Tornado, but I used a phishing website, and all the funds have been lost. I am devastated.'

    Crypto.news

    25 June 2025

    zkLend announces permanent shutdown of operations, citing the exploit's erosion of user confidence and the delisting of ZEND from Bybit and KuCoin. The remaining $200,000 treasury is allocated to a user recovery fund.

    DL News
    Provenance & Audit Trail
    Anchored on SolanaVerify on-chain16 Wayback Archives

    Decision Log

    This investigation is cryptographically anchored to the Solana blockchain (3 events). 16 of 19 cited source URLs have an Internet Archive snapshot.

    full audit log →version history →

    model: claude-sonnet-4-6

    generated: 8/2/2026, 12:31:23 PM

    last updated: 8/26/2026, 12:32:58 PM

    4 views

    avoid.net — verified advice for a post-truth world