On February 12, the L2 protocol zkLend, based on Starknet, suffered a loss of approximately 3666 ETH (valued at $9.6 million at the time of writing) due to a hack. The withdrawal function has been suspended.
To the hacker:
We understand that you are responsible for today’s attack on zkLend. You may keep 10% of the funds as a whitehat bounty, and send back the remaining 90%, or 3,300 ETH to be exact, to this Ethereum address: 0xCf31e1b97790afD681723fA1398c5eAd9f69B98C.
Upon… pic.twitter.com/piEVPDHZd4
— zkLend (@zkLend) February 12, 2025
The zkLend team offered the hacker the opportunity to voluntarily return 90% of the stolen amount (3300 ETH) to the specified address, allowing them to keep 10% (~$960,000) as a reward. The developers have promised to cease pursuing the perpetrator if the conditions are met by February 14, 00:00 UTC.
Otherwise, zkLend will forward the information to security firms and law enforcement agencies to track and apprehend the hacker.
Back in November 2024, a hacker returned $25.5 million stolen from the DeFi project Thala for a reward of $300,000.