zkLend's Total Value Locked (TVL) plunges approximately 90% to $1M after a $9.5M hack

zkLend's Total Value Locked (TVL) plunges approximately 90% to $1M after a $9.5M hack

In a shocking turn of events, zkLend, a lending protocol on the Starknet network, experienced a significant hack on February 12, 2025. The hack resulted in a 90% decrease in Total Value Locked (TVL), dropping from nearly $12 million to $1.1 million.

The attack led to substantial losses for zkLend, as well as other Starknet dapps such as Nostra and Vesu. zkLend lost over $4 million, representing over 10% of its TVL, while Vesu suffered a loss of $3 million, over 10% of its TVL. In total, the attack cost the affected parties approximately $10 million.

The hacker, who used Railgun to ensure anonymity during the attack, drained funds from zkLend using a fake Tornado Cash website. However, due to the hacker's own mishandling of the assets, a significant portion of the stolen funds were later lost.

Following the incident, zkLend paused all withdrawal operations and advised users to halt depositing or repaying loans. The daily outflows for zkLend reached a record high, with $6 million worth of ETH, $1.8 million worth of USDC, and $1.7 million worth of STRK being depleted.

The exploit originated from a loophole in the contract logic rather than a flaw in the ZK proof system. Despite the losses, zkLend remains uncertain if it will recover from the attack.

In an attempt to recover the stolen funds, zkLend is offering a 10% bounty for their return. The hacker is encouraged to transfer the funds to a provided Ethereum address, where they can receive a reward of 3,300 ETH, equivalent to nearly $8.8 million. If the hacker complies, zkLend has stated that they will release from any liability regarding the attack.

However, if the hacker does not comply, zkLend has warned that they will initiate legal actions. The deadline for the hacker to return the funds is February 14, 2025.

As of the available information, it is not clear if zkLend has fully recovered its TVL or resumed normal operations after the February 14 deadline. The reports mainly focus on the hack event and the immediate aftermath, including the hacker’s loss of funds and the protocol offering a bounty, but do not provide evidence of a full recovery or resumption of lending activities.

zkLend currently stands as the worst performer among dapps with at least $10,000 in TVL. Despite the challenges, the Starknet community remains hopeful for the future of zkLend and the recovery of the lost funds.

[1] Source: CoinDesk [2] Source: Decrypt [3] Source: The Block [4] Source: CoinTelegraph

Finance news reported a 10% loss for zkLend, totaling over $4 million, following a significant hack on February 12, 2025. Meanwhile, technology outlets like CoinDesk, Decrypt, The Block, and CoinTelegraph also covered the hack, focusing on the hacker's use of Railgun and the subsequent creation of a fake Tornado Cash website to drain funds from zkLend. Sports and daily news outlets have yet to provide updates on this matter.

Read also: