
In a recent turn of events, a critical security flaw within the smart contracts of zkLend, a decentralized cryptocurrency lending platform built on Ethereum’s Layer 2 scaling solution, Starknet, has been exploited by hackers. This malicious act resulted in the transfer of a staggering 3,600 Bitcoin, amounting to $9.5 million at the time of the incident.
Subsequent investigations have revealed that this security breach was rooted in a vulnerability within the zkLend smart contract application itself, unrelated to Starknet. As a result, the onus of resolving this security crisis falls solely on zkLend.
The cryptocurrency industry has already implemented warning systems to counter such hacker attacks. For instance, when hackers attempted to launder the stolen 3,300 Ethereum through RailGun, their privacy measures were thwarted. Furthermore, the hacker’s cryptocurrency addresses have been flagged within the industry, rendering any transactions to exchanges subject to freezing. Consequently, the hackers are currently exploring alternative avenues to exchange and launder these funds.
The question of whether zkLend possesses a solution to recover the stolen assets remains uncertain. Recovering assets once they’ve been transferred to hacker-controlled wallets is an extremely challenging task.
In response to this situation, zkLend has issued a statement demanding the hackers return 90% of the stolen funds, equivalent to approximately 3,300 Ethereum. They have offered a 10% reward, around 300 Ethereum, to the hackers as a vulnerability bounty, aiming to minimize their losses while incentivizing the hackers to return the stolen funds.
The deadline for the hackers to return the funds has been set for February 14, 2025, at 00:00 UTC+0000. zkLend has threatened to take further action, including collaborating with law enforcement agencies and security companies, if the stolen funds are not returned by the deadline.
At present, the hackers have not responded to zkLend’s demands. This is unsurprising, as hackers often find ways to launder stolen funds. The likelihood of hackers voluntarily returning stolen assets is historically low, although there have been rare instances where hackers have returned funds after being tracked down.