Audit log

Every state-changing event for zkLend: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-28 01:44:33Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,622,630

   sig

   ruTzUuZicVWC…PybPHPbMcopyexplorer ↗

   hash

   5uQVG3QykBYi…4VdqFvMzcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (7344 B) ▸

   {"actor":"system:backfill","investigation_id":"125788f2-a280-4a2b-b290-72b445456c7a","kind":"publish","page_slug":"zklend","published_at":"2026-05-28T01:44:33.409Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"zkLend","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.globenewswire.com/news-release/2022/03/29/2412153/0/en/StarkNet-money-market-zkLend-raises-5M-in-seed-round-led-by-Delphi-Digital.html","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/business/2022/03/29/delphi-digital-leads-5m-seed-round-for-money-market-protocol-zklend","type":"other","url":""},{"credibility":3,"name":"https://mirror.xyz/decentdao.eth/YlGq-m2b2r_mHaebYCiksOpnA1zA19CIWZCr_o_T8zs","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cointelegraph.com/press-releases/money-market-zklend-raises-5m-in-seed-round-led-by-delphi-digital","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/business/2022/03/29/delphi-digital-leads-5m-seed-round-for-money-market-protocol-zklend","type":"other","url":""},{"credibility":3,"name":"https://www.globenewswire.com/news-release/2022/03/29/2412153/0/en/StarkNet-money-market-zkLend-raises-5M-in-seed-round-led-by-Delphi-Digital.html","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://medium.com/zklend/zklend-security-incident-post-mortem-27d9abaf66f6","type":"other","url":""},{"credibility":3,"name":"https://blocksec.com/blog/zklend-exploit-post-mortem-unraveling-the-details-and-clarifying-misunderstandings-of-the-10m-flash-loan-attack","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-zklend-hack-february-2025","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/zklend-rekt","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/zklend-starknet-hack-4-9m-bounty","type":"other","url":""},{"credibility":3,"name":"https://cryptoslate.com/zklend-hack-sees-9-5m-exploit-offers-hacker-10-bounty-for-return/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://slowmist.medium.com/in-depth-analysis-of-zklend-hack-linked-to-eralend-hack-fba4af9b66ef","type":"other","url":""},{"credibility":3,"name":"https://bitcoinethereumnews.com/tech/starknets-zklend-hacked-by-same-attacker-as-eralend-reveals-slowmists-chandler-guo/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cointelegraph.com/news/zk-lend-hacker-loses-stolen-eth-after-depositing-it-into-a-tornado-cash-phishing-site","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2025/04/03/zklend-hacker-loses-5-4m-in-phishing-attack-while-using-tornado-cash/","type":"other","url":""},{"credibility":3,"name":"https://cryptoslate.com/hacker-falls-victim-to-phishing-scam-after-exploiting-zklend-for-millions/","type":"other","url":""},{"credibility":3,"name":"https://www.cryptopolitan.com/zklend-hacker-loses-funds-phishing/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://medium.com/zklend/zklend-compensation-plan-5682dcf91f57","type":"other","url":""},{"credibility":3,"name":"https://crypto.news/zklend-opens-recovery-portal-for-zklend-exploit-2025/","type":"other","url":""},{"credibility":3,"name":"https://cryptonews.com/news/zklend-launches-recovery-portal-for-victims-of-the-drained-9-6-million/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://crypto.news/starknet-based-l2-protocol-zklend-shuts-down/","type":"other","url":""},{"credibility":3,"name":"https://cryptobriefing.com/zklend-shutdown-zend-delisting/","type":"other","url":""},{"credibility":3,"name":"https://cryptonews.com/news/zklend-shuts-down-200k-recovery-fund-users/","type":"other","url":""},{"credibility":3,"name":"https://www.ainvest.com/news/zklend-shuts-9-5-million-exploit-allocates-200-000-recovery-fund-2506/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://github.com/NethermindEth/PublicAuditReports","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-zklend-hack-february-2025","type":"other","url":""},{"credibility":3,"name":"https://blocksec.com/blog/zklend-exploit-post-mortem-unraveling-the-details-and-clarifying-misunderstandings-of-the-10m-flash-loan-attack","type":"other","url":""}]}],"sources_used":[],"summary":"zkLend was a decentralized money-market lending protocol built on Starknet (Ethereum Layer 2), founded in 2022 by Brian Fu and Jane Ma and backed by Delphi Digital, Three Arrows Capital, and StarkWare. On February 11–12, 2025, the protocol suffered a critical flash-loan exploit that drained approximately $9.57 million in user funds through manipulation of the lending_accumulator variable and precision-loss rounding errors. The protocol permanently ceased operations in June 2025, allocating a $200,000 treasury remnant to a user recovery fund — leaving the vast majority of affected users uncompensated.","timeline":[{"date":"2022-02-01","event":"zkLend founded by Brian Fu and Jane Ma","source":""},{"date":"2022-03-29","event":"zkLend raises $5 million seed round led by Delphi Digital, with Three Arrows Capital, StarkWare, Alameda Research, and others participating","source":""},{"date":"2022-07-01","event":"zkLend testnet opens","source":""},{"date":"2023-07-25","event":"EraLend hack occurs (~$2.76 million loss); SlowMist later alleges the same attacker is responsible for the subsequent zkLend exploit","source":""},{"date":"2023-10-19","event":"zkLend officially launches on Starknet mainnet with Artemis and Apollo environments","source":""},{"date":"2025-02-11","event":"zkLend exploit begins; attacker manipulates wstETH market lending_accumulator via flash loans and rounding errors, draining approximately $9.57 million in ETH, USDC, STRK, and USDT","source":""},{"date":"2025-02-12","event":"zkLend suspends all withdrawals; publicly discloses exploit and offers 10% white hat bounty (~3,300 ETH) with February 14 deadline","source":""},{"date":"2025-02-14","event":"Attacker ignores white hat bounty deadline; funds not returned","source":""},{"date":"2025-02-14","event":"Stolen funds bridged to Ethereum; attacker attempts Railgun laundering — rejected by Railgun compliance policies, funds returned to attacker address","source":""},{"date":"2025-03-05","event":"zkLend opens Recovery Portal for affected users; compensation plan announced including ~82,818 recovery NFTs","source":""},{"date":"2025-03-31","event":"Attacker posts on-chain message to zkLend admitting to losing 2,930 ETH (~$5.4 million) to a fake Tornado Cash phishing site (tornadoeth.cash) while attempting to launder funds","source":""},{"date":"2025-06-25","event":"zkLend announces permanent shutdown of operations; cites hack fallout and ZEND token delistings from Bybit and KuCoin; allocates remaining $200,000 treasury to user recovery fund","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 28bd1fb4-ab01-492f-8935-f4cfc01ba723copy
2. #2rescoreby systemsystem

   2026-10-10 18:39:37Z
   Score: 20 → 50 (+30)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 20 → 50. Problems weighed by who is responsible: incidents the subject suffered −9.6, problems around the subject, caused by others −3.2, concerns that are not fraud −3.2; legitimacy credit long-running +6; no longer operating, so capped at 50.
   anchoranchored

   chain

   ●mainnet-betaslot 455,357,504

   sig

   5ZY522hvchKf…W3BKtZ1qcopyexplorer ↗

   hash

   EeZ7mZcJewzh…j2YqPb3Ccopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (675 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:39:37.055Z","decision":"rescore","investigation_id":"125788f2-a280-4a2b-b290-72b445456c7a","new_score":50,"page_slug":"zklend","prev_score":20,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 20 → 50. Problems weighed by who is responsible: incidents the subject suffered −9.6, problems around the subject, caused by others −3.2, concerns that are not fraud −3.2; legitimacy credit long-running +6; no longer operating, so capped at 50.","score_delta":30,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision fff4b4b6-add6-4ad1-b417-90b79df060afcopy
3. #3reviewby reviewerreviewer

   2026-11-01 22:17:51Z
   Score: 50 → 50 (no score change)
   The core narrative (February 2025 roughly $9.5-9.57M exploit, failed Railgun and Tornado phishing laundering, June 25, 2025 shutdown with about $200K to users) is supported by reachable sources. Weaknesses: the exploit section contains cross-page editorial text ('the zklend page' / 'the zklend-starknet page') rather than direct statements, one archive URL points to an unrelated article, the $500,000 bounty and founder biographies were not confirmed by fetched sources, and the law-enforcement cooperation statement is missing. Only a sample of claims was checked in depth; no hard disputes found.
   anchoranchored

   chain

   ●mainnet-betaslot 464,257,223

   sig

   5Qat9KGfh4xZ…fhpqSzD5copyexplorer ↗

   hash

   9WKaES4PNPvE…LWyKeBSfcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1446 B) ▸

   {"actor":"reviewer","artifact_identity":"d6521eb50f4ae788839179689754f23e","decided_at":"2026-11-01T22:17:51.507Z","decision":"review","disputed_pct":0.1111,"findings_hash":"3chJixkwBJF9cCNpLABCi6xw985MjDRPsca9vPKdFHeQ","investigation_id":"125788f2-a280-4a2b-b290-72b445456c7a","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":50,"omissions":{"material":0,"total":1},"page_content_hash":"08cfc8fdbb6af0d564651626664dd7af536568ee2c8ba3899a40a867e0f436d5","page_slug":"zklend","prev_score":50,"reason":"The core narrative (February 2025 roughly $9.5-9.57M exploit, failed Railgun and Tornado phishing laundering, June 25, 2025 shutdown with about $200K to users) is supported by reachable sources. Weaknesses: the exploit section contains cross-page editorial text ('the zklend page' / 'the zklend-starknet page') rather than direct statements, one archive URL points to an unrelated article, the $500,000 bounty and founder biographies were not confirmed by fetched sources, and the law-enforcement cooperation statement is missing. Only a sample of claims was checked in depth; no hard disputes found.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":3,"subject_status":"shut_down","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision eb7f8f1a-ca1a-4b70-ba32-4c96dfa237d1copy
4. #4review reviseby judgejudge

   2026-11-01 22:17:51Z
   Score: 50 → 50 (no score change)
   Of 9 claims checked, none were disputed and 1 could not be verified (claim_findings[8], the founder biographies, whose cited press release was not fetched), giving about 11%, just inside the minor band. The core account of the February 2025 exploit, the failed laundering attempts and the June 2025 shutdown was confirmed by multiple sources (claim_findings[0], [2], [3], [5]). Four claims were only partly supported: the $500,000 bounty is unconfirmed by the cited sources, the exploit section contains internal cross-page wording ('the zklend page' / 'the zklend-starknet page') instead of direct statements, one archive link points to an unrelated article, and zkLend's stated cooperation with law enforcement is missing. The omission is minor and the page already states the shutdown, so a small penalty and a revision are appropriate.
   anchoranchored

   chain

   ●mainnet-betaslot 464,257,227

   sig

   5sNt7t9MuKvb…3iXiFCSCcopyexplorer ↗

   hash

   Fe3AYD9NARno…bbCD3Fi2copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1479 B) ▸

   {"actor":"judge","artifact_identity":"d6521eb50f4ae788839179689754f23e","band_override":null,"decided_at":"2026-11-01T22:17:51.507Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.1111,"investigation_id":"125788f2-a280-4a2b-b290-72b445456c7a","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":50,"page_slug":"zklend","prev_score":50,"reason":"Of 9 claims checked, none were disputed and 1 could not be verified (claim_findings[8], the founder biographies, whose cited press release was not fetched), giving about 11%, just inside the minor band. The core account of the February 2025 exploit, the failed laundering attempts and the June 2025 shutdown was confirmed by multiple sources (claim_findings[0], [2], [3], [5]). Four claims were only partly supported: the $500,000 bounty is unconfirmed by the cited sources, the exploit section contains internal cross-page wording ('the zklend page' / 'the zklend-starknet page') instead of direct statements, one archive link points to an unrelated article, and zkLend's stated cooperation with law enforcement is missing. The omission is minor and the page already states the shutdown, so a small penalty and a revision are appropriate.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 8c206c8f-617c-45fc-bd6c-64b9a02b1129copy