{"investigation":{"slug":"lnd","entity_name":"LND","trust_score":12,"severity_base":null,"score_modifier":0,"confidence":0.78,"status":"published","content_type":"investigation","summary":"LND (lnd.fi) was a non-custodial, multichain DeFi lending protocol built on Sonic (a high-performance EVM chain) as a fork of Aave V3. On May 9, 2025, the protocol was drained of approximately $1.27–1.42 million by a developer who gained Pool Admin credentials and introduced a malicious access control modification 41 days before executing the exploit; the official postmortem attributed the attacker to a DPRK (North Korea) IT worker embedded in the team under false pretenses. As of mid-2025, the lnd.fi domain is no longer operated by the team and appears listed for resale, indicating the protocol ceased operations following the incident.","sections":[{"content":"LND.fi presented itself as an 'Interconnected Non-Custodial Money Markets' platform, describing its product as a modular, multichain lending and borrowing protocol. The protocol launched on Sonic mainnet in early 2025 and expanded to Hyperliquid L1 on May 5, 2025 — just four days before the security breach. At its peak, LND.fi had a total value locked (TVL) of approximately $1.3 million across Sonic and Hyperliquid L1. The team maintained a presence on X (Twitter) under the handle @Lnd_fi with approximately 1,600 followers, and publicly acknowledged support from SonicLabs and Andre Cronje prior to launch. LND.fi is not to be confused with Lightning Network Daemon (LND), the open-source Bitcoin Lightning Network implementation maintained by Lightning Labs, nor with Lendingblock (ERC-20 ticker: LND), a 2018 Ethereum ICO project.","heading":"Overview","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-lnd-hack-may-2025","name":"Explained: The LND Hack (May 2025) — Halborn Security","type":"research","credibility":2},{"url":"https://defillama.com/protocol/lnd","name":"LND Protocol — DefiLlama","type":"on_chain","credibility":2},{"url":"https://defihacklabs.substack.com/p/lnd-postmortem-127-million-loss","name":"LND Postmortem: $1.27 Million Loss — DeFiHackLabs / SunSec (Substack)","type":"research","credibility":2}],"severity":"medium"},{"content":"On May 9, 2025 at 2:29 AM UTC, the LND.fi deployer address (0xc0454e29835479ee80d6f42965a16dcee9bfd868) began draining the protocol's lending pools by exploiting a backdoor that had been inserted into two smart contracts 41 days earlier on March 29, 2025. The deployer had been granted the Pool Admin role on March 29, 2025, at 9:51 PM UTC, and immediately initialized modified AToken and VariableDebtToken contracts. The malicious modification altered the onlyPool access control modifier in the Aave V3 fork codebase, extending the ability to call the transferUnderlyingTo function — which transfers assets held by the pool to an arbitrary external address — to any address holding the Pool Admin role. By exploiting this, the deployer called transferUnderlyingTo and swept all assets from the protocol within approximately ten minutes. By 2:39 AM UTC, the stolen funds had been bridged to multiple wallets on Binance Smart Chain (approximately $786,000 USD) and Ethereum (approximately $397,000 USD, deposited to TradeOrge). An additional approximately $240,000 USD was bridged to MEXC via Hyperliquid. Total losses across independent assessments ranged from $1.18 million (Halborn) to $1.42 million (DeFiHackLabs postmortem). At 9:19 AM UTC on May 9, a separate address (0xe82e...aba4) revoked the Pool Admin role from the deployer. The official postmortem, authored by a team member identified as 'michaelmai' on HackMD, stated that 'the attack was carried out by a developer who was actually a DPRK IT worker.' This aligns with a broader documented pattern in 2024–2025 of North Korean state-sponsored operatives securing remote developer contracts at DeFi protocols in order to introduce malicious code. No independent investigator (including ZachXBT) has been specifically cited as confirming or denying the DPRK attribution in open-source reporting, and that attribution rests solely on the team's own postmortem.","heading":"May 2025 Hack: DPRK Insider Exploit","sources":[{"url":"https://hackmd.io/@michaelmai/LND-Postmortem","name":"LND Postmortem — HackMD (official team postmortem by michaelmai)","type":"official","credibility":2},{"url":"https://defihacklabs.substack.com/p/lnd-postmortem-127-million-loss","name":"LND Postmortem: $1.27 Million Loss — DeFiHackLabs / SunSec","type":"research","credibility":2},{"url":"https://www.halborn.com/blog/post/explained-the-lnd-hack-may-2025","name":"Explained: The LND Hack (May 2025) — Halborn Security","type":"research","credibility":2},{"url":"https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-may-2025","name":"Month in Review: Top DeFi Hacks of May 2025 — Halborn","type":"research","credibility":2}],"severity":"medium"},{"content":"The root cause of the exploit was a modification to the onlyPool access control modifier within the protocol's forked Aave V3 AToken and VariableDebtToken contracts. In the standard Aave V3 implementation, the transferUnderlyingTo function is exclusively callable by the pool contract address. The malicious modification changed this check to: _msgSender() == address(POOL) || aclManager.isPoolAdmin(msg.sender), thereby granting any Pool Admin role holder the ability to drain assets. The modification was introduced 41 days prior to exploitation, during the protocol's March 29, 2025 deployment phase, and remained publicly visible on-chain but was not detected or flagged. Security analysts at Halborn noted that multi-signature wallet controls over deployment keys, and automated on-chain monitoring for unauthorized contract modifications, could have prevented or significantly limited the attack. The fact that malicious code was deployed and left dormant for 41 days before activation is consistent with DPRK IT worker tactics documented in multiple 2024–2025 incidents across the DeFi industry.","heading":"Access Control Vulnerability: Technical Analysis","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-lnd-hack-may-2025","name":"Explained: The LND Hack (May 2025) — Halborn Security","type":"research","credibility":2},{"url":"https://defihacklabs.substack.com/p/lnd-postmortem-127-million-loss","name":"LND Postmortem: $1.27 Million Loss — DeFiHackLabs / SunSec","type":"research","credibility":2}],"severity":"medium"},{"content":"Following the exploit, stolen funds were distributed across multiple chains and intermediary addresses. The primary attacker address (0xc0454e29835479ee80d6f42965a16dcee9bfd868) routed funds through an accomplice address (0x40c79ebc5a8ee251a9670ba3f4c5720f874410c8) and a bridge operator address (0x5149a7696188f083297281d10293a20476252cdd). Approximately $786,000 was bridged to multiple wallets on Binance Smart Chain (BSC). Approximately $397,000 was sent to an Ethereum address and subsequently deposited to TradeOrge. Approximately $240,000 was bridged to MEXC via Hyperliquid. As of the available postmortem, no funds were reported recovered and no reimbursement plan was announced.","heading":"Fund Movement and On-Chain Forensics","sources":[{"url":"https://hackmd.io/@michaelmai/LND-Postmortem","name":"LND Postmortem — HackMD","type":"official","credibility":2},{"url":"https://defihacklabs.substack.com/p/lnd-postmortem-127-million-loss","name":"LND Postmortem: $1.27 Million Loss — DeFiHackLabs / SunSec","type":"research","credibility":2}],"severity":"medium"},{"content":"Following the May 9, 2025 incident, LND.fi froze its website and revoked the compromised account's Pool Admin privileges. As of mid-2025 (the time of this investigation), the lnd.fi domain no longer serves the protocol's application and appears to be listed for sale via a domain marketplace (Nameshift.com), strongly suggesting the project has ceased operations entirely. DefiLlama records show LND's TVL collapsed to effectively zero post-hack. No official wind-down announcement, user compensation plan, or regulatory disclosure has been identified in open-source reporting. ZachXBT flagged LND as a risk entity; however, specific public ZachXBT posts or threads dedicated to LND.fi have not been located in open-source reporting at this time.","heading":"Protocol Status Post-Hack","sources":[{"url":"https://defillama.com/protocol/lnd","name":"LND Protocol — DefiLlama TVL data","type":"on_chain","credibility":2},{"url":"https://www.halborn.com/blog/post/explained-the-lnd-hack-may-2025","name":"Explained: The LND Hack (May 2025) — Halborn Security","type":"research","credibility":2}],"severity":"medium"},{"content":"The alleged use of DPRK IT workers to infiltrate crypto projects is a documented and growing threat. The FBI has maintained a public advisory on DPRK IT fraud. ZachXBT independently published leaked DPRK payment server data in April 2026 showing a network generating approximately $1 million per month through fake developer identities embedded across multiple crypto firms, with over $3.5 million processed since November 2025. The Chainalysis blockchain analytics firm has also documented DPRK-linked IT worker laundering networks. In the LND.fi case, the DPRK attribution is based solely on the team's own postmortem; independent blockchain forensics confirmation has not been identified. This attribution, if accurate, would place LND.fi within a broader pattern of DPRK-sponsored insider attacks on DeFi protocols, which also allegedly includes the $285 million Drift Protocol exploit attributed (with medium confidence by Mandiant) to the DPRK-linked group UNC4736.","heading":"DPRK IT Worker Context","sources":[{"url":"https://www.theblock.co/post/396847/zachxbt-uncovers-north-korea-linked-it-worker-network-generating-1m-monthly-via-crypto-payment-flows","name":"ZachXBT uncovers North Korea-linked IT worker network — The Block","type":"news_article","credibility":2},{"url":"https://www.fbi.gov/wanted/cyber/dprk-it-fraud","name":"DPRK IT Workers — FBI Advisory","type":"regulatory","credibility":1},{"url":"https://www.chainalysis.com/blog/dprk-it-workers-north-korea-crypto-laundering-networks/","name":"North Korea IT Workers: Inside the DPRK's Crypto Laundering Network — Chainalysis","type":"research","credibility":2},{"url":"https://thehackernews.com/2026/04/285-million-drift-hack-traced-to-six.html","name":"$285 Million Drift Hack Traced to Six-Month DPRK Social Engineering Operation — The Hacker News","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Lendingblock (ERC-20 ticker: LND, contract: 0x0947b0e6d821378805c9598291385ce7c791a6b2 on Ethereum) is a separate entity that shares the LND ticker. Lendingblock was founded in October 2017 by Steve Swain and Linda Wang, both former Deloitte professionals, and conducted a $10 million ICO in April 2018 at $0.02 per token. The platform was designed as an institutional and consumer crypto lending and borrowing marketplace. In January 2022, Lendingblock announced a '2.0' rebrand, having licensed its technology to Nasdaq-listed Eqonex. As of mid-2024, Lendingblock's LND token shows $0 trading volume, zero active exchange listings (previously traded on HitBTC), and a $0 market cap, with approximately 4,949 on-chain token holders. The project has effectively gone dormant. No exit scam, rug pull, or legal action has been specifically documented, but the near-total abandonment of development and trading activity raises concerns about the project's long-term viability. Lendingblock is not the entity associated with the May 2025 DPRK hack.","heading":"Related Entity: Lendingblock (LND ERC-20 Token)","sources":[{"url":"https://etherscan.io/token/0x0947b0e6d821378805c9598291385ce7c791a6b2","name":"Lendingblock (LND) Token Tracker — Etherscan","type":"on_chain","credibility":1},{"url":"https://thefintechtimes.com/lending-platform-lendingblock-2/","name":"10 Questions For The Founders Of Lendingblock — The Fintech Times","type":"news_article","credibility":2},{"url":"https://medium.com/lendingblock/lendingblock-2-0-7b333415bb58","name":"Lendingblock 2.0 — Medium (official blog)","type":"official","credibility":2},{"url":"https://coinmarketcap.com/currencies/lendingblock/","name":"Lendingblock price today — CoinMarketCap","type":"other","credibility":2}],"severity":"medium"},{"content":"Lightning Network Daemon (LND) is an open-source Go implementation of the Bitcoin Lightning Network, maintained by Lightning Labs. LND is a legitimate, well-established open-source infrastructure project used widely in the Bitcoin ecosystem and is unrelated to either LND.fi or Lendingblock. However, LND has had documented security vulnerabilities: CVE-2024-38359 (the 'Onion Bomb') was a denial-of-service vulnerability in LND's onion processing logic patched in v0.17.0; and in February 2025, a critical vulnerability was disclosed in how LND processed description fields for AMP invoice settlement (affecting LND versions prior to 0.18.5 and LITD versions prior to 0.14.1), which could allow remote theft of Bitcoin from vulnerable nodes. Patched versions were released promptly. LND by Lightning Labs carries no fraud or scam designation and is not the basis for AVOID.NET's risk flag.","heading":"Related Entity: Lightning Network Daemon (LND by Lightning Labs)","sources":[{"url":"https://protos.com/bitcoin-lightning-bug-allows-remote-theft-of-bitcoin-via-lnd-nodes/","name":"Bitcoin Lightning bug allows remote theft of bitcoin via LND nodes — Protos","type":"news_article","credibility":2},{"url":"https://advisories.gitlab.com/pkg/golang/github.com/lightningnetwork/lnd/CVE-2024-38359/","name":"CVE-2024-38359: Lightning Network Daemon (LND) onion processing DoS — GitLab Advisory Database","type":"other","credibility":1},{"url":"https://github.com/lightningnetwork/lnd","name":"Lightning Network Daemon — GitHub (Lightning Labs)","type":"official","credibility":1}],"severity":"medium"}],"timeline":[{"date":"2025","event":"LND.fi protocol launches on Sonic mainnet (approximate early 2025 launch date; team publicly acknowledged SonicLabs support ahead of launch)","source":"","date_original":"2025-01-01"},{"date":"2025-03-29","event":"Deployer address (0xc0454e...) granted Pool Admin role on LND.fi contracts; modified AToken and VariableDebtToken contracts with backdoored access control initialized — 41 days before the exploit","source":""},{"date":"2025-05-05","event":"LND.fi goes live on Hyperliquid L1 with price feeds from Pyth Network and incentives via merkl.xyz, expanding from Sonic","source":""},{"date":"2025-05-09","event":"At 2:29 AM UTC, deployer begins draining LND.fi pools via the backdoored transferUnderlyingTo function; approximately $1.18–1.42 million stolen within minutes","source":""},{"date":"2025-05-09","event":"At 2:39 AM UTC, stolen funds bridged to wallets on BSC (~$786K) and Ethereum (~$397K, deposited to TradeOrge); ~$240K routed to MEXC via Hyperliquid","source":""},{"date":"2025-05-09","event":"At 9:19 AM UTC, Pool Admin role revoked by separate address (0xe82e...aba4); LND.fi freezes its website and revokes compromised account privileges","source":""},{"date":"2025-05-09","event":"Official postmortem published by team member 'michaelmai' on HackMD, attributing the attack to 'a developer who was actually a DPRK IT worker'","source":""},{"date":"2025-05","event":"Halborn Security publishes analysis of the LND hack as part of its May 2025 DeFi hacks review, confirming access control root cause and DPRK IT worker attribution","source":"","date_original":"2025-05-01"},{"date":"2025-06","event":"lnd.fi domain no longer operated by the LND team; domain listed for sale on Nameshift.com domain marketplace, indicating apparent protocol shutdown (approximate date)","source":"","date_original":"2025-06-01"}],"sources_used":[{"url":"https://www.halborn.com/blog/post/explained-the-lnd-hack-may-2025","name":"Explained: The LND Hack (May 2025) — Halborn Security","type":"research","archive_url":"http://web.archive.org/web/20260516233757/https://www.halborn.com/blog/post/explained-the-lnd-hack-may-2025","credibility":2,"archive_timestamp":"2026-05-16T23:37:57+00:00"},{"url":"https://defillama.com/protocol/lnd","name":"LND Protocol — DefiLlama","type":"on_chain","archive_url":"http://web.archive.org/web/20250913223800/https://defillama.com/protocol/lnd","credibility":2,"archive_timestamp":"2025-09-13T22:38:00+00:00"},{"url":"https://defihacklabs.substack.com/p/lnd-postmortem-127-million-loss","name":"LND Postmortem: $1.27 Million Loss — DeFiHackLabs / SunSec (Substack)","type":"research","archive_url":"https://web.archive.org/web/20260829031528/https://defihacklabs.substack.com/p/lnd-postmortem-127-million-loss","credibility":2,"archive_timestamp":"2026-08-29T03:15:28+00:00"},{"url":"https://hackmd.io/@michaelmai/LND-Postmortem","name":"LND Postmortem — HackMD (official team postmortem by michaelmai)","type":"official","archive_url":"http://web.archive.org/web/20260114000129/https://hackmd.io/@michaelmai/LND-Postmortem","credibility":2,"archive_timestamp":"2026-01-14T00:01:29+00:00"},{"url":"https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-may-2025","name":"Month in Review: Top DeFi Hacks of May 2025 — Halborn","type":"research","archive_url":"http://web.archive.org/web/20260317023402/https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-may-2025","credibility":2,"archive_timestamp":"2026-03-17T02:34:02+00:00"},{"url":"https://www.theblock.co/post/396847/zachxbt-uncovers-north-korea-linked-it-worker-network-generating-1m-monthly-via-crypto-payment-flows","name":"ZachXBT uncovers North Korea-linked IT worker network — The Block","type":"news_article","archive_url":"http://web.archive.org/web/20260410063840/https://www.theblock.co/post/396847/zachxbt-uncovers-north-korea-linked-it-worker-network-generating-1m-monthly-via-crypto-payment-flows","credibility":2,"archive_timestamp":"2026-04-10T06:38:40+00:00"},{"url":"https://www.fbi.gov/wanted/cyber/dprk-it-fraud","name":"DPRK IT Workers — FBI Advisory","type":"regulatory","archive_url":"http://web.archive.org/web/20260605071532/https://www.fbi.gov/wanted/cyber/dprk-it-fraud","credibility":1,"archive_timestamp":"2026-06-05T07:15:32+00:00"},{"url":"https://www.chainalysis.com/blog/dprk-it-workers-north-korea-crypto-laundering-networks/","name":"North Korea IT Workers: Inside the DPRK's Crypto Laundering Network — Chainalysis","type":"research","archive_url":"http://web.archive.org/web/20260412034829/https://www.chainalysis.com/blog/dprk-it-workers-north-korea-crypto-laundering-networks/","credibility":2,"archive_timestamp":"2026-04-12T03:48:29+00:00"},{"url":"https://thehackernews.com/2026/04/285-million-drift-hack-traced-to-six.html","name":"$285 Million Drift Hack Traced to Six-Month DPRK Social Engineering Operation — The Hacker News","type":"news_article","archive_url":"http://web.archive.org/web/20260803071205/https://thehackernews.com/2026/04/285-million-drift-hack-traced-to-six.html","credibility":2,"archive_timestamp":"2026-08-03T07:12:05+00:00"},{"url":"https://etherscan.io/token/0x0947b0e6d821378805c9598291385ce7c791a6b2","name":"Lendingblock (LND) Token Tracker — Etherscan","type":"on_chain","archive_url":"https://web.archive.org/web/20260829032638/https://etherscan.io/token/0x0947b0e6d821378805c9598291385ce7c791a6b2","credibility":1,"archive_timestamp":"2026-08-29T03:26:38+00:00"},{"url":"https://thefintechtimes.com/lending-platform-lendingblock-2/","name":"10 Questions For The Founders Of Lendingblock — The Fintech Times","type":"news_article","archive_url":"https://web.archive.org/web/20260829082246/https://thefintechtimes.com/lending-platform-lendingblock-2/","credibility":2,"archive_timestamp":"2026-08-29T08:22:46+00:00"},{"url":"https://medium.com/lendingblock/lendingblock-2-0-7b333415bb58","name":"Lendingblock 2.0 — Medium (official blog)","type":"official","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://coinmarketcap.com/currencies/lendingblock/","name":"Lendingblock price today — CoinMarketCap","type":"other","archive_url":"http://web.archive.org/web/20260518103015/https://coinmarketcap.com/currencies/lendingblock/","credibility":2,"archive_timestamp":"2026-05-18T10:30:15+00:00"},{"url":"https://protos.com/bitcoin-lightning-bug-allows-remote-theft-of-bitcoin-via-lnd-nodes/","name":"Bitcoin Lightning bug allows remote theft of bitcoin via LND nodes — Protos","type":"news_article","archive_url":"http://web.archive.org/web/20260312111049/https://protos.com/bitcoin-lightning-bug-allows-remote-theft-of-bitcoin-via-lnd-nodes/","credibility":2,"archive_timestamp":"2026-03-12T11:10:49+00:00"},{"url":"https://advisories.gitlab.com/pkg/golang/github.com/lightningnetwork/lnd/CVE-2024-38359/","name":"CVE-2024-38359: Lightning Network Daemon (LND) onion processing DoS — GitLab Advisory Database","type":"other","archive_url":"http://web.archive.org/web/20260212200320/https://advisories.gitlab.com/pkg/golang/github.com/lightningnetwork/lnd/CVE-2024-38359/","credibility":1,"archive_timestamp":"2026-02-12T20:03:20+00:00"},{"url":"https://github.com/lightningnetwork/lnd","name":"Lightning Network Daemon — GitHub (Lightning Labs)","type":"official","archive_url":"http://web.archive.org/web/20260730002654/https://github.com/lightningnetwork/lnd","credibility":1,"archive_timestamp":"2026-07-30T00:26:54+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:23.706046+00:00","updated_at":"2026-08-29T18:16:46.779073+00:00"}}