zkLend loses $9.5M in crypto heist, asks hacker to return 90%

zkLend, a Starknet-based decentralized money-market protocol, was exploited via a rounding error in its smart contract mint() function allowing an attacker to drain approximately 3,600 ETH (~$9.5M). Starkware clarified the flaw was application-specific, the attacker attempted to launder funds via RailGun but was blocked, and zkLend publicly offered a 10% bounty if 90% (3,300 ETH) is returned; there is no attribution for the actor.