zkLend Hacker Loses $5.4M in Phishing Attack While Using Tornado Cash

In a dramatic turn of events, the hacker behind the February 2025 zkLend exploit has fallen victim to a major setback with losing $5.4 million worth of Ethereum (ETH) in a phishing scam while attempting to launder the stolen funds through Tornado Cash. 

The onchain analytics firm Lookonchain noted that the Karma has hit back to the hacker who stole 2,930 ETH from zkLend loses it all in a phishing scam to another hacker. 

“Hello I tried to move funds to tornado but I used a phishing website and all the funds have been lost. I am devastated. I am terribly sorry for all the havoc and losses caused,” the zkLend hacker said in an onchain message sent to zkLend deployer address, adding “All the 2930 eth have been taken by that site owners. I do not have coins. Please redirect your efforts towards those site owners to see if you can recover some of the money.”

The zkLend breach saw the attacker siphon off approximately $9.5 million of ETH. However, this innocent now confirms that the hacker has fallen victim to a fake Tornado Cash website dubbed tornadoeth[.]cash, which has been operating undetected for over five years. As a result, all 2,930 ETH were stolen by another scammer. 

Tornado Cash, a cryptocurrency mixing service designed to obscure transaction trails, has long been a prime target for phishing schemes. There are several malicious actors who have deployed convincing replica websites to trick users into unknowingly handing over their assets. The zkLend hacker’s misstep underscores the persistent risks in the crypto space, where even cybercriminals are not immune to fraud. 

The incident also reflects a troubling trend in rising crypto scams and security breaches. According to Immunefi’s Q1 2025 report, the first quarter of the year saw a record-breaking $1.64 billion stolen in various crypto-related attacks, marking the worst quarter in the history for crypto security. 

For zkLend users and the broader crypto community, this ironic twist serves as both a cautionary tale and a testament to the ever-evolving dangers lurking in the digital asset landscape.