Another day, another DeFi hack. 

This time it's zkLend getting their pockets emptied faster than a rookie trader in a bear market.

Their innovative approach to fixing the issue? 

Bribe the hackers to get their money back… let’s just hope these guys are white hats and willing to play ball.

The Damage Report

On February 12th, some anonymous sleuths made off with $9M worth of ETH from zkLend's Starknet protocol. 

Their response was to simply slide into the hacker's DMs with an offer they hope won't be refused.

You see, hacking a protocol like this constitutes a little thing known as “crime,” – but zkLend is playing it cool and offering the hacker 10% ($900k) to return the other 90%.

If the hacker agrees, then it becomes a case of penetration testing and an agreement that’s not all that uncommon in on-chain software development.

But, should the hacker refuse, then it’s absolutely a case of theft, and those coins are blacklisted… unless they make their way to Tornado Cash, but that’s another matter entirely. 

They've given the hacker until February 14th at midnight UTC to take the deal. 

Nothing says Valentine's Day like returning stolen crypto, right?

The Squad Has Assembled

zkLend isn’t fighting this one alone – they've called in a whole crew of crypto experts to help track down the ne'er-do-well and get those funds back. 

The roster includes Starknet Foundation, StarkWare, Zero Shadow, Binance Security Team, and Hypernative Labs – quite the list of heavy hitters. 

Meanwhile, the hacker is sitting on $7,021,001.31 in their wallet, likely planning their next move. 

Talk about a high-stakes game. 

And, of course, this proves that DeFi is still about as secure as a rusted latch on a two-foot-high fence.

Even fancy L2s like Starknet aren't immune to someone stepping over and grabbing what’s inside.

Give Back, Or Take It All?

Will the hacker take the $900k and call it a day? 

Will zkLend actually catch them if they don't?

Does anyone really believe that "we'll release you from liability" line?

Only time will tell, but the big takeaway here is that you should maybe think twice before aping into the next "totally secure" DeFi protocol.