Hacker Who Exploited zkLend to Drain $5.4M Falls Victim to Phishing Attack

Crypto market has recently witnessed a surprising twist as a hacker has fallen victim to an exploit. As per the data from PeckShieldAlert, the hacker responsible for looting $5.4M in Ethereum ($ETH) from the StarkNet-based decentralized money-making platform zkLend, has eventually lost funds to a phishing scam. The blockchain security platform revealed this incident on its official social media account.

Hacker Loses All 2,930 $ETH Exploited from zkLend to Phishing Site Impersonating Tornado Cash

PeckShieldAlert’s data discloses that the hacker has formerly stolen up to 2,930 $ETH coins from zkLend. Nonetheless, while endeavoring to launder the exploited assets via the crypto mixing platform Tornado Cash, the hacker was hit by a phishing attack. As a result of this, the hacker lost funds to another hacker. Particularly, in an attempt to obscure the tracks of the funds by using Tornado Cash, the hacker unintentionally interacted with a phishing website. Hence, the malicious actor running the fraudulent website took away the funds stolen by the hacker.

The on-chain analytics point out that the hacker was utilizing the address 0xD89…..0f1F5 to shift the exploited funds. Nevertheless, they utilized a phishing website and ultimately lost control of those assets. Following that, the hacker sent a message through the Ethereum blockchain to express regret.

Hacker Expresses Regret for zkLend’s Losses, Further Urging Them to Recover Funds

In line with the message, the hacker attempted to shift funds to Tornado Cash, nevertheless, the mistaken use of a phishing website allowed another exploiter to drain the funds. This devastated the hacker, and he expressed regret for zkLend’s losses. The hacker confirmed that all the $5.4M stolen from zkLend were subsequently lost to the phishing website. After that, the hacker does not have any coins left. This message further persuaded zkLend to focus their attention toward funds recovery from the respective phishing website.