zkLend (Starknet)
Summary
zkLend was a decentralized money-market lending protocol built on the Starknet L2 network. On February 12, 2025, the protocol suffered a critical exploit caused by a decimal precision vulnerability in its lending_accumulator mechanism, resulting in approximately $9.57 million in user funds being drained. The protocol subsequently shut down in June 2025, returning only a nominal $200,000 treasury to affected users.
Connected Entities
1 entities · 10 linked investigationsTimeline(10 events)
2022-03-29
zkLend raises $5 million seed round led by Delphi Digital, with participation from Three Arrows Capital, Alameda Research, StarkWare, and others.
GlobeNewswire2023-07-25
EraLend, a lending protocol on zkSync, is exploited for approximately $3.4 million via a read-only reentrancy vulnerability. On-chain forensics would later link attacker addresses to the subsequent zkLend hack.
Halborn Security2023-10-01
zkLend's Cairo 1 smart contracts are audited by Nethermind and deployed on Starknet ahead of Starknet Regenesis.
zkLend Documentation2025-02-12
Attacker exploits the lending_accumulator decimal precision vulnerability, draining approximately $9.57 million (including 2,930+ ETH, USDC, USDT, STRK) from zkLend's liquidity pools on Starknet.
Rekt News2025-02-12
zkLend issues on-chain and public bounty offer: 10% white-hat reward (~3,300 ETH) with February 14 midnight UTC deadline in exchange for return of remaining funds and promise of no legal action.
CoinTelegraph2025-02-12
Attacker attempts to launder 706.4 WETH through Railgun privacy protocol. Railgun's exclusion policies automatically return the funds to the originating address.
Rekt News2025-02-14
Bounty deadline passes with no response or fund return from the attacker. zkLend states it will pursue legal action and engage forensics firm zeroShadow.
CoinTelegraph2025-03-05
zkLend opens a recovery portal for affected users, outlining partial compensation for deposits in affected pools and full compensation for unaffected pool deposits.
Crypto.news2025-04-01
The zkLend attacker loses 2,930 ETH (approximately $5.4 million) by depositing stolen funds into a fake Tornado Cash phishing website. The attacker sends an on-chain message to zkLend's deployer address: 'I tried to move funds to Tornado, but I used a phishing website, and all the funds have been lost. I am devastated.'
Crypto.news2025-06-25
zkLend announces permanent shutdown of operations, citing the exploit's erosion of user confidence and the delisting of ZEND from Bybit and KuCoin. The remaining $200,000 treasury is allocated to a user recovery fund.
DL NewsDecision Log
- #1publish⛓ pending8/2/2026, 12:31:36 PMhash: 9MWwSxsHcsdbQWLPodtCQyaEjx4ZF5eHN5pGjzkZF4sR
16 of 19 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/2/2026, 12:31:23 PM
last updated: 8/2/2026, 5:16:07 PM
avoid.net — verified advice for a post-truth world