In February 2025, a hacker exploited zkLend, a decentralized lending protocol built on the Starknet blockchain.

He drained 2,930 ETH, approximately $9.5 million, through a smart contract vulnerability.
After successfully doing so, he tried to move the funds through Tornado Cash to hide his tracks.
But while doing that, he clicked on a phishing link that looked like the official site.
The fake page instantly drained his wallet.
Like that, every $ETH he stole just disappeared.
The entire exploit, everything he worked on, was lost in one mistake.
Then it got even stranger.
He sent messages on the blockchain to zkLend and the victims asking for help to recover the funds.
Completely ignoring the fact that he had just admitted it on the permanent public ledger.
In the end, someone capable of breaking a DeFi protocol was caught by a basic phishing trap.
He walked away empty-handed.
And the blockchain keeps the whole story forever.