zkLend announced it would shut down after a February exploit drained several million dollars from the Starknet lending protocol through a decimal precision vulnerability in its smart contracts. The team planned to direct its remaining treasury to a user recovery fund and keep its DeFi Spring, recovery, and kSTRK portals open, while token delistings limited new initiatives.
zkLend announces its closure following a February cyberattack that drained millions of dollars in ether. The team directs remaining treasury funds to user compensation, keeps its recovery, DeFi Spring, and kSTRK services online, and opens its updated protocol source code to third parties.
The hacker who drained thousands of ether from Starknet money-market protocol zkLend in a February 2025 exploit claimed to have lost most of the stolen funds to a fake Tornado Cash phishing site. zkLend had offered a bounty for returning user funds, and its team said investigators found no conclusive evidence linking the exploiter to the phishing operators.
