How much was lost in the zkLend hack?

$9.55M Starknet Exploit, as publicly reported (February 11, 2025).

zkLend Hack: $9.55M Starknet Exploit

Q: How was the zkLend hack carried out?

Empty-Market Exploit & Bridge Out. Dust deposit into an empty zkLend market inflated the lending accumulator; rounding-down on withdrawals let the attacker extract value repeatedly. Proceeds were bridged from Starknet to Ethereum mainnet, exiting the L2's visibility.

February 11, 2025 · Starknet / Ethereum

stolen

$9.55M

What happened

On February 11, 2025, zkLend — a lending protocol on Starknet — was exploited for $9.55M. The attacker seeded an empty lending market with a dust deposit, then manipulated the market's lending accumulator through repeated flash-loan-funded deposits and withdrawals, abusing rounding behavior to withdraw more than was ever deposited. The proceeds were bridged from Starknet to Ethereum mainnet. ChainHint holds no fund-flow trace of its own for this incident: the graph that once sat on this row was built against Ethereum mainnet rather than Starknet, and was cleared on 2026-09-16. zkLend publicly offered the attacker a whitehat deal to return 90% of the funds; no deal materialized. The case took a bizarre turn weeks later when the hacker claimed on-chain to have lost the bulk of the stolen ETH to a phishing website impersonating a mixer's frontend — thief phished by thieves.

How the funds moved

Step 1

Empty-Market Exploit & Bridge Out

Dust deposit into an empty zkLend market inflated the lending accumulator; rounding-down on withdrawals let the attacker extract value repeatedly. Proceeds were bridged from Starknet to Ethereum mainnet, exiting the L2's visibility.

Step 2

Layering on Ethereum

On mainnet, the proceeds were split and moved on through intermediary wallets, with mixer routes among the destinations reported at the time.

Step 3

The Phishing Twist

The hacker later claimed to have sent a large share of the loot to a phishing site mimicking a mixer, losing it to a second set of criminals. The trail past that point continues under different control — a rare case of stolen funds being re-stolen.

Key findings

Source Wallet (Ethereum side)

0x55f5…9c33zkLend Exploiter — mainnet consolidation address after bridging proceeds from Starknet

ExploiterCross-chain

Root Cause

Empty-market accumulator manipulationA dust deposit into an uninitialized market plus flash-loan-driven accumulator inflation and rounding-down on withdrawal math — an economic exploit, not a code-injection attack.

Rounding Exploit

Aftermath

Hacker phished — loot lost to fake mixerThe exploiter claimed on-chain that most of the stolen ETH was sent to a phishing site impersonating a mixer frontend. The funds moved on under new ownership.

Re-stolen

Trace Scope

No trace of our ownThis case holds no fund-flow trace of its own: Starknet is not among the chains our tracer supports, so the bridge off it is where our evidence stops.

Investigate your own incident

ChainHint traced the zkLend hack in minutes.
Use the same tool for your case.