In February 2025, a hacker exploited zkLend, a decentralized lending protocol built on the Starknet blockchain He drained 2,930 ETH, roughly $9.5 million, through a smart contract vulnerability After pulling it off, he tried to move the funds through Tornado Cash to hide the trail But while doing that, he clicked a phishing link that looked like the real site The fake page drained his wallet instantly Just like that, every single $ETH he stole was gone The whole exploit, everything he worked for, wiped out in one mistake Then it got even stranger He sent an on-chain message to zkLend and the victims asking for help recovering the funds Completely ignoring the fact that he had just confessed on a permanent public ledger In the end, someone capable of breaking a DeFi protocol got caught by a basic phishing trap He walked away with nothing And the blockchain kept the full story forever