A hacker stole 2930 ETH ($5.4 million) from zkLend, and then mistakenly visited a phishing website impersonating TornadoCash — as a result, all 2930 ETH went to another thief.