The hacker behind the $9.6 million zkLend exploit claimed to have lost stolen funds to a phishing site posing as Tornado Cash.
How zkLend was Exploited
zkLend was exploited on February 11 when an attacker inflated the lending accumulator using a small deposit and flash loans. The hacker attempted to launder the stolen funds on Ethereum but failed due to Railgun policies returning the funds to the original address.
Loss of Funds to Phishing Site
On March 31, the hacker informed zkLend of losing 2,930 ETH to a phishing site posing as Tornado Cash. The hacker realized the loss only after completing the transaction.
Response and Fallout
zkLend responded to the hacker's message by asking for the return of remaining funds. Meanwhile, another user warned the hacker about the mistake. Losses from scams and hacks totaled nearly $1.53 billion in February, with the largest theft being $1.4 billion from Bybit by North Korea's Lazarus Group.
The zkLend incident highlights vulnerabilities in crypto protocol security and the importance of vigilance when using online services.
