In yet another crypto hacking incident, ZkLend Next generation lending protocol has officially confirmed that it was hacked, resulting in the loss of 3,300 ETH. In an unusual move, zkLend publicly addressed the hacker via an X post, offering a 10% white hat bounty if the remaining 90% of the stolen funds are returned. This translates to the hacker keeping 10% while returning approximately 3,300 ETH to the specified Ethereum address.
CertiK Alert reported that zkLend on Starknet experienced multiple attack transactions, resulting in the theft of approximately $5 million. The stolen funds were bridged to Ethereum via the address 0x04d7191dc8eac499bac710dd368706e3ce76c9945da52535de770d06ce7d3b26.
A Deal to Waive Liability
According to zkLend’s statement, if the hacker agrees with the request and returns the funds, the platform will waive any legal liabilities related to the attack. However, if no response is received by 00:00 UTC on February 14, 2025, zkLend has warned that it will proceed with legal actions, collaborating with security firms and law enforcement to track and prosecute the hacker.
Withdrawals Suspended, Investigation Ongoing
In response to the breach, zkLend has suspended all withdrawal functions on its protocol to prevent further risks. The team is working closely with security firms, including StarkWare Ltd, Starknet Foundation, zeroshadow.io (formerly Chainalysis Incident Response), Binance Security Team, and Hypernative Labs. They are actively tracking the stolen funds and investigating the root cause of the exploit.
The crypto community has reacted strongly to the incident. A crypto user pointed out that the stolen funds can’t be quickly moved to the mainnet due to the 12-hour withdrawal wait time required by the STARK official bridge. The user emphasized that the project team must ensure the funds are recovered, hinting at suspicions of internal involvement if the recovery fails.
However, zkLend has promised full transparency throughout the investigation. They plan to release a comprehensive post-mortem report once the analysis is complete. The platform reassured its community that user trust remains a top priority, and they are doing everything possible to resolve the situation swiftly and securely.
function subscribed_popupmodal(template_id) {
var templateId = ‘6’;
getAllSubscriberCategoryList([templateId]);
var subcribemodal = window.parent.document.getElementById(‘subscribe-modal-design’);
if (subcribemodal) {
var modalContent = `
Never Miss a Beat in the Crypto World!
Stay informed and gain the edge you need to navigate the crypto world. Select your subscription now
if (storeCheckedId.length === 0) {
var unsubcribedPopUpmodal =
`
You’ve Unsubscribed Successfully
We’re sorry to see you go! Your subscription has been canceled. If you change your mind, you can re-subscribe anytime. Thank you for being part of our community!
Thank you for subscribing to our crypto and blockchain newsletter! You’ll now receive the latest news, insights, and updates straight to your inbox. Welcome to our community!
`;
let selectedSubscriptionsArray = selectedSubscriptionsString.split(‘,’);
let subscribedCategories = selectedSubscriptionsArray.map(subscription => subscription.split(‘_’)[0]);
let subscribedCategoriesString = subscribedCategories.join(‘, ‘);
subscribedmodal.innerHTML = subscribedPopupModal;
if (document.getElementById(‘selectidname’)) {
document.getElementById(‘selectidname’).textContent = subscribedCategoriesString;
}
function closeModal(template_id) {
var modalId = template_id;
var modal = document.querySelector(‘#’ + modalId); // Using querySelector to find the modal
// Function to get cookies
function getCookie(name) {
let value = “; ” + document.cookie;
let parts = value.split(“; ” + name + “=”);
if (parts.length == 2) return parts.pop().split(“;”).shift();
}
// Get user token from cookies
const userToken = getCookie(‘user_token’);
if (subscribewithoutData === ‘true’ && userToken) {
// Call the modal function with the category ID
subscribed_popupmodal(subscribe_clicked_cat_id);
// Remove the flag and category ID from localStorage
localStorage.removeItem(‘subscribe_without_Login’);
localStorage.removeItem(‘subscribe_clicked_id’);
}
});
var listItems = document.querySelectorAll(‘.subscription-options li’);
if (listItems.length === 0) return;
var anyActive = false;
listItems.forEach(function(item) {
var checkbox = item.querySelector(‘input[type=”checkbox”]’);
if (checkbox) {
if (checkbox.checked) {
item.classList.add(‘active’);
anyActive = true; // Set anyActive to true
} else {
item.classList.remove(‘active’); // Remove ‘active’ class if checkbox is unchecked
}
}
});
}
function updateButtonText(anyActive) {
var subscribeButtonSpan = document.querySelector(‘.subscribe-submit .changeBtnText’);
if (subscribeButtonSpan) {
if (anyActive) {
subscribeButtonSpan.textContent=”Subscribe Now”;
} else {
subscribeButtonSpan.textContent=”Unsubscribe”;
}
}
}
function updateSubscriptionButton() {
var listItems = document.querySelectorAll(‘.subscription-options li’);
if (listItems.length === 0) return;
var anyActive = false;
listItems.forEach(function(item) {
var checkbox = item.querySelector(‘input[type=”checkbox”]’);
if (checkbox) {
if (checkbox.checked) {
item.classList.add(‘active’);
anyActive = true; // Set anyActive to true
} else {
item.classList.remove(‘active’); // Remove ‘active’ class if checkbox is unchecked
}
}
});
// Update the button text based on whether any list item has the ‘active’ class
updateButtonText(anyActive);
}
document.addEventListener(‘click’, function(event) {
var clickedItem = event.target.closest(‘.subscription-options li’);
if (clickedItem) {
var checkbox = clickedItem.querySelector(‘input[type=”checkbox”]’);
if (checkbox) {
checkbox.checked = !checkbox.checked;
updateSubscriptionButton();
}
}
});