zkLend Hack: Genuine Apology or Orchestrated Drama? HasBeen90チZkLend hack was also stolen, is the on-chain apology a sincere repentance or a self-directed performance?
The April Fools' Day joke for this year came out early: a hacker got hacked, and the stolen ETH got phished. After the zkLend hacker stole 2930 ETH, they fell victim to a phishing website, causing a complete loss of funds. Now, the hacker has publicly apologized to the zkLend team through an on-chain message, claiming to have "broken down," and pleading with the team to investigate the phishing website operator to recover the losses. Is this a case of poetic justice or just another one of the hacker's tricks? Let's find out.

From Hacker to "Victim"
In February of this year, zkLend—a decentralized lending protocol based on the Starknet network—was hit by a devastating attack. The hacker exploited a "rounding error" bug in the smart contract, making off with 3600 ETH. The zkLend team had previously reached out to the hacker, offering to let them keep 10% as a "white hat bounty" if they returned 90% (3300 ETH) and absolved them of legal consequences. However, the hacker did not respond, swiftly moving the funds to the Ethereum network and attempting to launder the stolen ETH using the privacy protocol Railgun. While Railgun managed to force the funds back, thwarting the hacker's laundering attempt, the trail briefly went cold.
Related Read: "$5 Million Stolen Funds Rejected, Mixer Railgun Turns Into DeFi Protocol "Debt Collection Tool"?"
Just when everyone thought the stolen funds had disappeared without a trace, on April 1st, SlowMist's founder, 余弦 (Yu Xian), revealed a dramatic twist: the hacker switched to Tornado Cash to further obfuscate the fund flow but mistakenly clicked on a phishing website disguised as Tornado Cash, leading to the vanishing of 2930 ETH.
What's even more surprising is that the hacker then proactively contacted zkLend through an on-chain message, expressing deep remorse: "Hello, I intended to transfer the funds to Tornado Cash, but mistakenly used a phishing site, resulting in the complete loss of all funds. I am devastated. I apologize deeply for the confusion and losses caused by this. All 2930 ETH has been taken by the operator of that website, and I no longer have any coins in my possession. Please focus your efforts on those website operators to see if you can recover some of the funds. This is my final message, and perhaps ending it all is the best choice. Sorry again."

This "Confession Letter" quickly exploded in the crypto community. In the message, the hacker not only admitted their mistakes but also expressed remorse, even hinting at a possible "retirement" from the scene. However, this "sincere confession" inevitably raised doubts about its authenticity.
How Does the Community See It?
After the incident was exposed, some jokingly referred to it as the "hacker version of an April Fools' joke," lamenting that "if you live by the sword, you die by the sword"; while others quipped, "It's like a scammer from Myanmar getting scammed by a psoriasis ad on a street lamp post."

Aside from just spectating, some community members pointed out that the hacker might be orchestrating a drama, using the guise of a "victim" to divert attention, or even colluding with the phishing site operator to whitewash their identity or obfuscate the fund's destination. However, based on cosine tracing, this phishing site has been undercover for 5 years. If this hacker drama is indeed self-directed, it seems a bit too "patient." Currently, although the hacker's wallet has indeed been emptied, the possibility of hidden accounts behind the scenes cannot be ruled out.
As of the time of writing, zkLend has not yet issued a formal response to the hacker's message. Previously, on March 5th, the project team launched a "Recovery Portal," offering partial compensation to affected users and promising to strengthen security measures. Now, the zkLend theft incident seems to have staged a "black-on-black" drama in the crypto world. Will the hacker's proactive plea lead zkLend to collaborate with law enforcement to trace the phishing site? Or is this just a distraction for the hacker to "whitewash" themselves? Is the hacker's "confession letter" a genuine repentance or a carefully crafted "April Fools' humor"? BlockBeats will continue to track and report on the progress of the event.
You may also like

Consumer-grade Crypto Global Survey: Users, Revenue, and Track Distribution

Prediction Markets Under Bias

Stolen: $290 million, Three Parties Refusing to Acknowledge, Who Should Foot the Bill for the KelpDAO Incident Resolution?

ASTEROID Pumped 10,000x in Three Days, Is Meme Season Back on Ethereum?

ChainCatcher Hong Kong Themed Forum Highlights: Decoding the Growth Engine Under the Integration of Crypto Assets and Smart Economy

Why can this institution still grow by 150% when the scale of leading crypto VCs has shrunk significantly?

Anthropic's $1 trillion, compared to DeepSeek's $100 billion

Geopolitical Risk Persists, Is Bitcoin Becoming a Key Barometer?

Annualized 11.5%, Wall Street Buzzing: Is MicroStrategy's STRC Bitcoin's Savior or Destroyer?

An Obscure Open Source AI Tool Alerted on Kelp DAO's $292 million Bug 12 Days Ago

Mixin has launched USTD-margined perpetual contracts, bringing derivative trading into the chat scene.
The privacy-focused crypto wallet Mixin announced today the launch of its U-based perpetual contract (a derivative priced in USDT). Unlike traditional exchanges, Mixin has taken a new approach by "liberating" derivative trading from isolated matching engines and embedding it into the instant messaging environment.
Users can directly open positions within the app with leverage of up to 200x, while sharing positions, discussing strategies, and copy trading within private communities. Trading, social interaction, and asset management are integrated into the same interface.
Based on its non-custodial architecture, Mixin has eliminated friction from the traditional onboarding process, allowing users to participate in perpetual contract trading without identity verification.
The trading process has been streamlined into five steps:
· Choose the trading asset
· Select long or short
· Input position size and leverage
· Confirm order details
· Confirm and open the position
The interface provides real-time visualization of price, position, and profit and loss (PnL), allowing users to complete trades without switching between multiple modules.
Mixin has directly integrated social features into the derivative trading environment. Users can create private trading communities and interact around real-time positions:
· End-to-end encrypted private groups supporting up to 1024 members
· End-to-end encrypted voice communication
· One-click position sharing
· One-click trade copying
On the execution side, Mixin aggregates liquidity from multiple sources and accesses decentralized protocol and external market liquidity through a unified trading interface.
By combining social interaction with trade execution, Mixin enables users to collaborate, share, and execute trading strategies instantly within the same environment.
Mixin has also introduced a referral incentive system based on trading behavior:
· Users can join with an invite code
· Up to 60% of trading fees as referral rewards
· Incentive mechanism designed for long-term, sustainable earnings
This model aims to drive user-driven network expansion and organic growth.
Mixin's derivative transactions are built on top of its existing self-custody wallet infrastructure, with core features including:
· Separation of transaction account and asset storage
· User full control over assets
· Platform does not custody user funds
· Built-in privacy mechanisms to reduce data exposure
The system aims to strike a balance between transaction efficiency, asset security, and privacy protection.
Against the background of perpetual contracts becoming a mainstream trading tool, Mixin is exploring a different development direction by lowering barriers, enhancing social and privacy attributes.
The platform does not only view transactions as execution actions but positions them as a networked activity: transactions have social attributes, strategies can be shared, and relationships between individuals also become part of the financial system.
Mixin's design is based on a user-initiated, user-controlled model. The platform neither custodies assets nor executes transactions on behalf of users.
This model aligns with a statement issued by the U.S. Securities and Exchange Commission (SEC) on April 13, 2026, titled "Staff Statement on Whether Partial User Interface Used in Preparing Cryptocurrency Securities Transactions May Require Broker-Dealer Registration."
The statement indicates that, under the premise where transactions are entirely initiated and controlled by users, non-custodial service providers that offer neutral interfaces may not need to register as broker-dealers or exchanges.
Mixin is a decentralized, self-custodial privacy wallet designed to provide secure and efficient digital asset management services.
Its core capabilities include:
· Aggregation: integrating multi-chain assets and routing between different transaction paths to simplify user operations
· High liquidity access: connecting to various liquidity sources, including decentralized protocols and external markets
· Decentralization: achieving full user control over assets without relying on custodial intermediaries
· Privacy protection: safeguarding assets and data through MPC, CryptoNote, and end-to-end encrypted communication
Mixin has been in operation for over 8 years, supporting over 40 blockchains and more than 10,000 assets, with a global user base exceeding 10 million and an on-chain self-custodied asset scale of over $1 billion.

$600 million stolen in 20 days, ushering in the era of AI hackers in the crypto world

Vitalik's 2026 Hong Kong Web3 Summit Speech: Ethereum's Ultimate Vision as the "World Computer" and Future Roadmap

On the same day Aave introduced rsETH, why did Spark decide to exit?

Full Post-Mortem of the KelpDAO Incident: Why Did Aave, Which Was Not Compromised, End Up in Crisis Situation?

After a $290 million DeFi liquidation, is the security promise still there?

ZachXBT's post ignites RAVE nearing zero, what is the truth behind the insider control?


