Audit log

Every state-changing event for zkLend (Starknet): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-02 12:31:36Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   9MWwSxsHcsdb…jzkZF4sRcopysha256 → base58

   verifying row…

   canonical bytes (21418 B) ▸

   {"actor":"system:backfill","investigation_id":"cb094bff-6724-4483-9acf-fad4d5cebb15","kind":"publish","page_slug":"zklend-starknet","published_at":"2026-08-02T12:31:36.793Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"zkLend (Starknet)","sections":[{"content":"zkLend was a decentralized money-market protocol deployed on Starknet, a zero-knowledge rollup built on Ethereum. It allowed users to deposit and borrow crypto assets including ETH, wstETH, USDC, USDT, and STRK. The protocol issued a native governance token, ZEND, and was backed by prominent crypto venture investors including Delphi Digital (lead), Three Arrows Capital, Alameda Research, StarkWare, Genesis Block Ventures, CMS, Amber Group, and others. Its seed round in March 2022 raised $5 million. The protocol's Cairo 1 smart contracts were audited by Nethermind prior to deployment in October 2023; earlier Cairo 0 contracts had also undergone audit and formal specification.","heading":"Protocol Overview","severity":"low","sources":[{"credibility":2,"name":"Delphi Digital Leads $5M Seed Round for ZkLend (Yahoo Finance)","type":"news_article","url":"https://finance.yahoo.com/news/delphi-digital-leads-5m-seed-122929760.html"},{"credibility":2,"name":"StarkNet money market zkLend raises $5M in seed round (GlobeNewswire)","type":"news_article","url":"https://www.globenewswire.com/news-release/2022/03/29/2412153/0/en/StarkNet-money-market-zkLend-raises-5M-in-seed-round-led-by-Delphi-Digital.html"},{"credibility":2,"name":"zkLend Audit and Formal Specification (zkLend Documentation)","type":"official","url":"https://zklend.gitbook.io/documentation/using-zklend/technical/audit-and-formal-specification"}]},{"content":"On February 12, 2025, an attacker exploited a decimal precision vulnerability in zkLend's lending_accumulator variable, draining approximately $9.57 million (2,930 ETH plus USDC, USDT, and STRK) from the protocol. The attack did not rely solely on a flash loan in the conventional sense; rather, it chained three underlying vulnerabilities.\n\nFirst, the attacker identified that the wstETH market held zero balance, allowing a deposit of just 1 wei of wstETH to bootstrap the exploit. Second, the attacker executed 10 flash loan calls on the wstETH market, borrowing 1 wei of wstETH each time but repaying a larger amount. The excess repayment was treated as a 'donation,' updating the global lending_accumulator variable. Through this mechanism, the accumulator escalated from 1.0 to approximately 4,069,297,906,051,644,020 (roughly 4.069 x 10^18). Third, a rounding vulnerability in the zwstETH token burning logic caused division to round down during withdrawal, meaning the attacker's raw_balance decreased by only 1 unit despite burning more than 6 tokens in each cycle. By repeatedly depositing and withdrawing, the attacker's raw_balance grew from 2 to 1,724, representing approximately 7,015 wstETH in inflated collateral value. The attacker then used this artificially inflated collateral to borrow all other liquid assets from the protocol's pools. BlockSec's post-mortem clarified that the attacker did not profit from wstETH deposited by other users; the vulnerability enabled inflation of the attacker's own collateral rather than direct theft from other depositors' wstETH positions.","heading":"February 2025 Exploit — Technical Analysis","severity":"critical","sources":[{"credibility":2,"name":"zkLend Exploit Post-Mortem: Unraveling the Details (BlockSec Blog)","type":"research","url":"https://blocksec.com/blog/zklend-exploit-post-mortem-unraveling-the-details-and-clarifying-misunderstandings-of-the-10m-flash-loan-attack"},{"credibility":2,"name":"Explained: The zkLend Hack February 2025 (Halborn Security)","type":"research","url":"https://www.halborn.com/blog/post/explained-the-zklend-hack-february-2025"},{"credibility":2,"name":"zkLend — Rekt News","type":"news_article","url":"https://rekt.news/zklend-rekt"}]},{"content":"The attacker deployed a custom attack contract on Starknet and executed the exploit on February 12, 2025. Following the theft, the attacker converted stolen tokens to ETH and employed multiple cross-chain bridges — including LayerSwap, Orbiter Bridge, Rhino.fi, and StarkGate — to move approximately $9.5 million across chains. A primary receiving address on Ethereum was 0x645c77833833A6654F7EdaA977eBEaBc680a9109. The attacker subsequently attempted to launder 706.4 WETH through Railgun, a privacy-focused protocol. Railgun's exclusion policies automatically returned those funds to the originating address, preventing successful mixing. The attacker then attempted to use Tornado Cash for laundering. On approximately April 1, 2025, the attacker mistakenly deposited 2,930 ETH (valued at approximately $5.4 million at the time) into a fake Tornado Cash phishing site, losing the entirety of those funds to a secondary scammer. The attacker subsequently sent an on-chain message to zkLend's deployer address stating: 'I tried to move funds to Tornado, but I used a phishing website, and all the funds have been lost. I am devastated.'","heading":"Attacker Actions and Fund Movements","severity":"critical","sources":[{"credibility":2,"name":"zkLend — Rekt News","type":"news_article","url":"https://rekt.news/zklend-rekt"},{"credibility":2,"name":"zkLend hacker loses 2,930 stolen ETH to Tornado Cash phishing scam (Crypto.news)","type":"news_article","url":"https://crypto.news/zklend-hacker-loses-all-2930-stolen-eth-to-tornadocash-phishing-scam/"},{"credibility":2,"name":"zkLend Hacker Loses $5.4M in Phishing Attack While Using Tornado Cash (CryptoTimes)","type":"news_article","url":"https://www.cryptotimes.io/2025/04/03/zklend-hacker-loses-5-4m-in-phishing-attack-while-using-tornado-cash/"},{"credibility":2,"name":"Vitalik Buterin Breaks Silence on zkLend Exploit, Flaunts Railgun (U.Today)","type":"news_article","url":"https://u.today/vitalik-buterin-breaks-silence-on-zklend-exploit-flaunts-railgun"}]},{"content":"Blockchain security firm SlowMist published an in-depth on-chain forensic analysis establishing a probable link between the zkLend attacker and the person or group responsible for the EraLend exploit of July 25, 2023. EraLend was a decentralized lending protocol on zkSync that suffered a read-only reentrancy exploit resulting in approximately $3.4 million in losses. SlowMist identified that the Starknet attacker address (0x04d7191dc8eac499bac710dd368706e3ce76c9945da52535de770d06ce7d3b26) conducted test transactions with three Ethereum L1 addresses before the zkLend attack: 0xd95b3c1e638ce3cdc070ad6d4f385c61e2ee8662, 0x93920786e0fda8496248c4447e2e082da69b6c40, and 0x34e5dc779cb705200e951239b6a89aaf5c7dbfc1. Two of those addresses — 0x93920786e0fda8496248c4447e2e082da69b6c40 and 0x34e5dc779cb705200e951239b6a89aaf5c7dbfc1 — had previously received stolen funds from the EraLend attack. Comparable bridge usage patterns were also noted across both incidents. This attribution rests on on-chain forensics and has not been confirmed by law enforcement.","heading":"Link to EraLend Exploit (July 2023)","severity":"high","sources":[{"credibility":2,"name":"In-Depth Analysis of zkLend Hack Linked to EraLend Hack (SlowMist / Medium)","type":"research","url":"https://slowmist.medium.com/in-depth-analysis-of-zklend-hack-linked-to-eralend-hack-fba4af9b66ef"},{"credibility":2,"name":"SlowMist: zkLend attacker is same hacker as EraLend 2023 (PANews)","type":"news_article","url":"https://www.panewslab.com/en/sqarticledetails/3n036o62.html"},{"credibility":2,"name":"Explained: The Eralend Hack July 2023 (Halborn Security)","type":"research","url":"https://www.halborn.com/blog/post/explained-the-eralend-hack-july-2023"}]},{"content":"Following the exploit, zkLend issued an on-chain message and public statement offering the attacker a standard 10% white-hat bounty — equivalent to approximately 3,300 ETH — with a deadline of February 14, 2025 at midnight UTC. The offer included a promise of no legal action if the remaining funds were returned. The attacker did not respond and did not return funds before or after the deadline. zkLend subsequently stated it was pursuing legal channels and working with the blockchain forensics firm zeroShadow to trace and recover funds. On March 5, 2025, zkLend opened a recovery portal for affected users, advising users to verify communications through official channels. Deposits in pools unaffected by the exploit were expected to receive full recovery; deposits in affected pools were to receive partial recovery plus a claim position in zkLend's recovery pool.","heading":"Protocol Response and Bounty Offer","severity":"high","sources":[{"credibility":1,"name":"zkLend loses $9.5M in exploit, offers bounty to hacker (CoinTelegraph)","type":"news_article","url":"https://cointelegraph.com/news/zklend-starknet-hack-4-9m-bounty"},{"credibility":2,"name":"zkLend opens recovery portal for users after $9.6M exploit (Crypto.news)","type":"news_article","url":"https://crypto.news/zklend-opens-recovery-portal-for-zklend-exploit-2025/"},{"credibility":2,"name":"zkLend Compensation Plan (zkLend / Medium)","type":"official","url":"https://medium.com/zklend/zklend-compensation-plan-5682dcf91f57"}]},{"content":"On June 25, 2025, zkLend announced it was permanently winding down operations. The team cited two primary causes: the February exploit had 'deeply eroded user confidence,' and the subsequent delisting of the ZEND token from major exchanges including Bybit and KuCoin had 'constrained token liquidity and accessibility.' The protocol allocated its remaining treasury of approximately $200,000 toward a user recovery fund — a figure representing a small fraction of the approximately $9.57 million lost in the exploit. The team indicated it would maintain access to the DeFi Spring, recovery, and kSTRK portals for users to unstake or claim remaining funds. zkLend also committed to open-sourcing its audited and updated codebase. The zeroShadow collaboration for fund recovery was stated to continue, with any future recoveries directed to the user fund. The $200,000 total recovery is effectively a near-total loss for affected depositors.","heading":"Protocol Shutdown and User Impact","severity":"critical","sources":[{"credibility":2,"name":"Starknet-based ZkLend Shuts Down Amid Fallout From $10 Million Exploit (The Defiant)","type":"news_article","url":"https://thedefiant.io/news/defi/starknet-based-zklend-shuts-down-amid-fallout-from-usd10-million-exploit"},{"credibility":2,"name":"zkLend Shuts Down: $200K Recovery Fund for Users (CryptoNews)","type":"news_article","url":"https://cryptonews.com/news/zklend-shuts-down-200k-recovery-fund-users/"},{"credibility":2,"name":"DeFi lending protocol hits the white flag four months after $9M hack (DL News)","type":"news_article","url":"https://www.dlnews.com/articles/defi/defi-protocol-zklend-shuts-down-four-months-after-9m-hack/"},{"credibility":2,"name":"zkLend Winds Down After February Exploit Erodes Confidence (Unchained Crypto)","type":"news_article","url":"https://unchainedcrypto.com/zklend-winds-down-after-february-exploit-erodes-confidence/"},{"credibility":2,"name":"Starknet-based zkLend shuts down following exploit and ZEND token delisting (CryptoBriefing)","type":"news_article","url":"https://cryptobriefing.com/zklend-shutdown-zend-delisting/"}]},{"content":"zkLend's 2022 seed round was led by Delphi Digital and included participation from Three Arrows Capital — the crypto hedge fund that subsequently collapsed in June 2022 amid insolvency and was later subject to bankruptcy and liquidation proceedings. Other notable investors included Alameda Research, which itself filed for bankruptcy in November 2022 following the collapse of FTX. The involvement of two now-defunct institutional investors in zkLend's seed round is a matter of historical record. There is no public evidence that Three Arrows Capital or Alameda Research's failures directly caused operational problems for zkLend prior to the February 2025 exploit.","heading":"Investor and Backer Concerns","severity":"medium","sources":[{"credibility":2,"name":"Delphi Digital Leads $5M Seed Round for ZkLend (Yahoo Finance)","type":"news_article","url":"https://finance.yahoo.com/news/delphi-digital-leads-5m-seed-122929760.html"},{"credibility":2,"name":"Layer-2 money market zkLend raises $5 million in seed round (CryptoSlate)","type":"news_article","url":"https://cryptoslate.com/layer-2-money-market-zklend-raises-5-million-in-seed-round/"}]},{"content":"zkLend's Cairo 1 contracts underwent an audit by Nethermind prior to deployment in October 2023. Earlier Cairo 0 contracts were also audited and formally specified. The February 2025 exploit demonstrates that the decimal precision vulnerability in the lending_accumulator mechanism was not identified or remediated during those audits. The vulnerability pattern — rounding errors in accumulator-based lending math — is a known class of DeFi exploit. The audited codebase nonetheless contained the flaw that enabled the $9.57 million loss. zkLend stated it plans to open-source the updated and audited codebase following shutdown.","heading":"Audit Record and Smart Contract Security","severity":"high","sources":[{"credibility":2,"name":"zkLend Audit and Formal Specification (zkLend Documentation)","type":"official","url":"https://zklend.gitbook.io/documentation/using-zklend/technical/audit-and-formal-specification"},{"credibility":2,"name":"zkLend Hack: $10M Exploit Exposes Starknet Vulnerabilities (OKX Learn)","type":"news_article","url":"https://www.okx.com/learn/zklend-hack-starknet-defi-vulnerabilities"}]}],"sources_used":[{"credibility":2,"name":"zkLend — Rekt News","type":"news_article","url":"https://rekt.news/zklend-rekt"},{"credibility":2,"name":"Explained: The zkLend Hack February 2025 (Halborn Security)","type":"research","url":"https://www.halborn.com/blog/post/explained-the-zklend-hack-february-2025"},{"credibility":2,"name":"zkLend Exploit Post-Mortem (BlockSec Blog)","type":"research","url":"https://blocksec.com/blog/zklend-exploit-post-mortem-unraveling-the-details-and-clarifying-misunderstandings-of-the-10m-flash-loan-attack"},{"credibility":2,"name":"Starknet-based ZkLend Shuts Down Amid Fallout From $10 Million Exploit (The Defiant)","type":"news_article","url":"https://thedefiant.io/news/defi/starknet-based-zklend-shuts-down-amid-fallout-from-usd10-million-exploit"},{"credibility":2,"name":"In-Depth Analysis of zkLend Hack Linked to EraLend Hack (SlowMist / Medium)","type":"research","url":"https://slowmist.medium.com/in-depth-analysis-of-zklend-hack-linked-to-eralend-hack-fba4af9b66ef"},{"credibility":2,"name":"Explained: The Eralend Hack July 2023 (Halborn Security)","type":"research","url":"https://www.halborn.com/blog/post/explained-the-eralend-hack-july-2023"},{"credibility":1,"name":"zkLend loses $9.5M in exploit, offers bounty to hacker (CoinTelegraph)","type":"news_article","url":"https://cointelegraph.com/news/zklend-starknet-hack-4-9m-bounty"},{"credibility":2,"name":"zkLend Shuts Down: $200K Recovery Fund for Users (CryptoNews)","type":"news_article","url":"https://cryptonews.com/news/zklend-shuts-down-200k-recovery-fund-users/"},{"credibility":2,"name":"DeFi lending protocol hits the white flag four months after $9M hack (DL News)","type":"news_article","url":"https://www.dlnews.com/articles/defi/defi-protocol-zklend-shuts-down-four-months-after-9m-hack/"},{"credibility":2,"name":"zkLend hacker loses 2,930 stolen ETH to Tornado Cash phishing scam (Crypto.news)","type":"news_article","url":"https://crypto.news/zklend-hacker-loses-all-2930-stolen-eth-to-tornadocash-phishing-scam/"},{"credibility":2,"name":"Delphi Digital Leads $5M Seed Round for ZkLend (Yahoo Finance)","type":"news_article","url":"https://finance.yahoo.com/news/delphi-digital-leads-5m-seed-122929760.html"},{"credibility":2,"name":"StarkNet money market zkLend raises $5M seed round (GlobeNewswire)","type":"news_article","url":"https://www.globenewswire.com/news-release/2022/03/29/2412153/0/en/StarkNet-money-market-zkLend-raises-5M-in-seed-round-led-by-Delphi-Digital.html"},{"credibility":2,"name":"SlowMist: zkLend attacker is same hacker as EraLend 2023 (PANews)","type":"news_article","url":"https://www.panewslab.com/en/sqarticledetails/3n036o62.html"},{"credibility":2,"name":"zkLend Compensation Plan (zkLend / Medium)","type":"official","url":"https://medium.com/zklend/zklend-compensation-plan-5682dcf91f57"},{"credibility":2,"name":"zkLend Audit and Formal Specification (zkLend Documentation)","type":"official","url":"https://zklend.gitbook.io/documentation/using-zklend/technical/audit-and-formal-specification"},{"credibility":2,"name":"zkLend opens recovery portal for users (Crypto.news)","type":"news_article","url":"https://crypto.news/zklend-opens-recovery-portal-for-zklend-exploit-2025/"},{"credibility":2,"name":"Starknet-based zkLend shuts down following exploit and ZEND token delisting (CryptoBriefing)","type":"news_article","url":"https://cryptobriefing.com/zklend-shutdown-zend-delisting/"},{"credibility":2,"name":"zkLend Winds Down After February Exploit Erodes Confidence (Unchained Crypto)","type":"news_article","url":"https://unchainedcrypto.com/zklend-winds-down-after-february-exploit-erodes-confidence/"},{"credibility":2,"name":"zkLend Hacker Loses $5.4M in Phishing Attack While Using Tornado Cash (CryptoTimes)","type":"news_article","url":"https://www.cryptotimes.io/2025/04/03/zklend-hacker-loses-5-4m-in-phishing-attack-while-using-tornado-cash/"}],"summary":"zkLend was a decentralized money-market lending protocol built on the Starknet L2 network. On February 12, 2025, the protocol suffered a critical exploit caused by a decimal precision vulnerability in its lending_accumulator mechanism, resulting in approximately $9.57 million in user funds being drained. The protocol subsequently shut down in June 2025, returning only a nominal $200,000 treasury to affected users.","timeline":[{"date":"2022-03-29","event":"zkLend raises $5 million seed round led by Delphi Digital, with participation from Three Arrows Capital, Alameda Research, StarkWare, and others.","source":"GlobeNewswire","source_url":"https://www.globenewswire.com/news-release/2022/03/29/2412153/0/en/StarkNet-money-market-zkLend-raises-5M-in-seed-round-led-by-Delphi-Digital.html"},{"date":"2023-07-25","event":"EraLend, a lending protocol on zkSync, is exploited for approximately $3.4 million via a read-only reentrancy vulnerability. On-chain forensics would later link attacker addresses to the subsequent zkLend hack.","source":"Halborn Security","source_url":"https://www.halborn.com/blog/post/explained-the-eralend-hack-july-2023"},{"date":"2023-10-01","event":"zkLend's Cairo 1 smart contracts are audited by Nethermind and deployed on Starknet ahead of Starknet Regenesis.","source":"zkLend Documentation","source_url":"https://zklend.gitbook.io/documentation/using-zklend/technical/audit-and-formal-specification"},{"date":"2025-02-12","event":"Attacker exploits the lending_accumulator decimal precision vulnerability, draining approximately $9.57 million (including 2,930+ ETH, USDC, USDT, STRK) from zkLend's liquidity pools on Starknet.","source":"Rekt News","source_url":"https://rekt.news/zklend-rekt"},{"date":"2025-02-12","event":"zkLend issues on-chain and public bounty offer: 10% white-hat reward (~3,300 ETH) with February 14 midnight UTC deadline in exchange for return of remaining funds and promise of no legal action.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/zklend-starknet-hack-4-9m-bounty"},{"date":"2025-02-12","event":"Attacker attempts to launder 706.4 WETH through Railgun privacy protocol. Railgun's exclusion policies automatically return the funds to the originating address.","source":"Rekt News","source_url":"https://rekt.news/zklend-rekt"},{"date":"2025-02-14","event":"Bounty deadline passes with no response or fund return from the attacker. zkLend states it will pursue legal action and engage forensics firm zeroShadow.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/zklend-starknet-hack-4-9m-bounty"},{"date":"2025-03-05","event":"zkLend opens a recovery portal for affected users, outlining partial compensation for deposits in affected pools and full compensation for unaffected pool deposits.","source":"Crypto.news","source_url":"https://crypto.news/zklend-opens-recovery-portal-for-zklend-exploit-2025/"},{"date":"2025-04-01","event":"The zkLend attacker loses 2,930 ETH (approximately $5.4 million) by depositing stolen funds into a fake Tornado Cash phishing website. The attacker sends an on-chain message to zkLend's deployer address: 'I tried to move funds to Tornado, but I used a phishing website, and all the funds have been lost. I am devastated.'","source":"Crypto.news","source_url":"https://crypto.news/zklend-hacker-loses-all-2930-stolen-eth-to-tornadocash-phishing-scam/"},{"date":"2025-06-25","event":"zkLend announces permanent shutdown of operations, citing the exploit's erosion of user confidence and the delisting of ZEND from Bybit and KuCoin. The remaining $200,000 treasury is allocated to a user recovery fund.","source":"DL News","source_url":"https://www.dlnews.com/articles/defi/defi-protocol-zklend-shuts-down-four-months-after-9m-hack/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 076c7e76-29cc-4344-b151-878ff6c743c8copy