EraLend Review 2026: zkSync Lender Hit by a $3.4M Exploit

EraLend, previously known as Nexon Finance, was a decentralized lending protocol that described itself as a low-risk, capital-efficient money market on zkSync Era. It went live in early 2023 and was at one point described as the largest lending protocol on zkSync.

In July 2023 it suffered a read-only reentrancy attack that cost about $3.4 million. Within days the team said it would stop seeking reconciliation with the attacker. Later reports said some stolen funds were moved to exchanges.

Today the protocol's total value locked is about $36, with no native token. That points to a project that has effectively stopped functioning as a lending market, so this page is mainly a record of what it was and what happened.

A lending protocol pools assets from suppliers. Suppliers deposit tokens and receive a claim on the pool that earns interest. Borrowers post collateral worth more than they take out, and interest paid by borrowers flows to suppliers.

If a borrower's collateral value falls too far, the position can be liquidated to protect the pool. This depends on accurate price data from oracles and from on-chain markets, which is where EraLend failed. In July 2023 an attacker used a read-only reentrancy flaw to manipulate a value the protocol relied on, and drained about $3.4 million.

EraLend said its design aimed to limit dependence on external liquidity and oracles. The exploit shows that this goal was not fully achieved in practice.

EraLend does not publish a fee schedule in the material available. As with most lending protocols, costs would normally include borrow interest set by pool utilization, a share of interest kept as a reserve, and network gas fees on zkSync Era or Telos.

Users would see the live rates for each asset inside the lending app. Because the protocol holds almost no liquidity today, quoted rates would not reflect a functioning market.

EraLend suffered a $3.4 million read-only reentrancy exploit in July 2023. That is a direct smart-contract failure, and funds were not fully recovered according to the reports available. Two audits are listed, but the exploit happened regardless, which shows the limits of audits.

The protocol's current TVL is about $36, so there is almost nothing to secure and no sign of active operation. The team, custody arrangements and any regulatory status are not published. Treat any interaction with remaining contracts as high risk.

Mainly former EraLend users checking on old positions, and researchers studying the 2023 zkSync exploit. It is not suited to new depositors or borrowers, given the minimal liquidity and the security history.