A Single Wei and a Broken Accumulator Cost zkLend $9.57 Million

A precision flaw in zkLend's lending math, not a cryptographic weakness, is what let an attacker walk away with $9.57 million from the Starknet-based lending protocol. The stolen funds — more than 2,200 ETH plus quantities of USDC, STRK, and USDT — were pulled out through a chain of flash-loan transactions that manipulated a single internal accounting variable until it produced free tokens.

01How the exploit worked

The attacker's entry point was zkLend's lending_accumulator, a variable meant to track interest accrual. The attack began with a deposit of just one wei into an otherwise empty market. From there, a custom-deployed attack contract used repeated flash loans to push the accumulator from a baseline of 1.0 up to 851.0 within a single transaction. Each subsequent loan repayment nudged the figure higher, until it landed on a specific value: 4.069297906051644020.

Once the accumulator sat at that number, the rounding behavior of zkLend's deposit and withdrawal logic could be gamed directly: depositing 4.069297906051644021 wstETH returned only 2 wei, and a subsequent withdrawal of 6.103946859077466029 wstETH cost the attacker just 1 wei. Analysts at SlowMist later described the underlying accounting logic as imprecise enough to be exploited this way. Repeating this pattern let the attacker mint value essentially at will, ultimately extracting $9.57 million without needing any novel zero-day.

02Tracing the funds

On Starknet, the attacker's wallet was identified at 0x04d7191dc8eac499bac710dd368706e3ce76c9945da52535de770d06ce7d3b26, operating through an attack contract at 0x0193da87dc0b317f8418ae0c8fb3e0301698ed2d1a4047191d4641ddabc1e2bf against the zkLend market at 0x04c0a5193d58f74fbace4b74dcf65481e734ed1714121bdc571da345540efa05.

The attacker then bridged 1,801 ETH over to Ethereum (bridging message: 0xee7887af574928f92cc80384cd9febb41aa4f18c97133c974206f8a2b9baba09; Ethereum-side transaction: 0xe107aca6535c8b67356dfa2d741bb3d4c4374f558b58a70f8e34e4c1bf1328e7), landing at the Ethereum address 0x645c77833833A6654F7EdaA977eBEaBc680a9109.

From there, an attempt was made to launder a portion of the proceeds through Railgun, a privacy protocol. The attacker moved 706.4 ETH to a secondary address (0x1262d9cebafe097e8e7223f685238ef4ef87bcf8b1fe5e2c13e60ef226f78f97), used the wallet 0xCf677c7520E02acA89BC70431eAC891e94273E8a to deposit 706.4 WETH into Railgun (0x7309db8034a421a319dc7073a41da4679f93a1a4bab8793c026666837e7846d4), but the deposit was rejected and returned (0xf185675b2c2000d1d39f189594be223b78e389cc229b4ec4051b810b920bb125) under Railgun's built-in exclusion mechanism, which enforces a one-hour cooling period and can auto-return flagged deposits without any manual intervention. Ethereum co-founder Vitalik Buterin later pointed to the episode as an example of privacy tooling that screens bad actors without undermining the broader privacy model.

As of the reporting, roughly $8 million remained sitting in the primary Ethereum wallet 0x645c77833833A6654F7EdaA977eBEaBc680a9109, with about $720,000 moved into a second wallet, 0x0B7D061D91018AaB823A755020e625FfE8B93074, and a smaller $19,000 tranche sent to 0xcd1c290198E12c4c1809271e683572FBF977Bb63.

03Disclosure and response

zkLend disclosed the incident itself on X on February 11. StarkWare responded the following morning, stating that its core technology was unaffected and that the issue was confined to the application layer. Security firm CertiKAlert published an early technical breakdown identifying the lending_accumulator manipulation as the root mechanism.

About six hours after the exploit, zkLend sent an on-chain message to the attacker offering the standard 10% white-hat bounty in exchange for returning 3,300 ETH by 00:00 UTC on February 14 — with a warning of prosecution if the deadline was missed. The attacker did not respond, and the deadline passed with no funds returned. zkLend subsequently published a post-mortem, though notably via an unverified Google Drive link rather than a conventional channel, which included claims that the FBI and Department of Homeland Security were involved in the investigation.

04A repeat offender

According to a detailed write-up from SlowMist, on-chain evidence ties the zkLend attacker to the same actor behind the EraLend reentrancy exploit from July 2023. Before targeting zkLend, the attacker reportedly used their Starknet address to run test transactions against three Ethereum Layer 1 addresses: 0xd95b3c1e638ce3cdc070ad6d4f385c61e2ee8662, 0x93920786e0fda8496248c4447e2e082da69b6c40, and 0x34e5dc779cb705200e951239b6a89aaf5c7dbfc1. Two of these — the latter two listed — had previously received funds tied to the EraLend attack, and the Starknet wallet itself has reportedly been active since June 2024.

zkLend's own post-mortem went further, alleging the same actor was also behind incidents at OnyxDAO, Yei Finance, Channels Finance, and Starlay Finance. Unlike the EraLend link, however, these additional claims were not accompanied by transaction evidence, leaving them unverified.

05Audit history

zkLend had been audited twice by Nethermind — once in May 2022 covering its Cairo 0 contracts, and again in September 2023 after migrating to Cairo 1. zkLend stated that neither audit turned up critical issues. Its post-mortem attributed the exploit to three design choices that were individually low-risk but became exploitable in combination: allowing deposits into empty markets, accepting unsolicited token "donations," and rounding behavior on withdrawals. Whether these conditions predated the audits or were introduced afterward was not clarified in the post-mortem.

The episode underscores that a clean audit history does not guarantee immunity from arithmetic-level flaws, particularly in protocols handling accumulator-style interest calculations across flash-loan-enabled environments.