Lendf.me
Last changed 2026-11-01 · Fact-check review — Fact-check review (verdict: revise): the reviewer checked the page's claims against its sources; the trust score did not change. Version history →
Why this score
| Every page starts at | 65 |
| Incidents it suffered (e.g. hacks) | -9.6 |
| Problems around it, caused by others | -2.4 |
| Long-running | +6 |
| Regulated | +5 |
| Sum | 64 |
- No longer operating, so capped at 50.
- 1 section set aside: the claims did not hold up in a fact-check, pending correction.
Score: 50/100 (kept between 0 and 100)
How scoring works →Page reliability: Fact-checked 2026-11-01 · 5 of 10 claims confirmed · 5 need better sources
anchored·3VQQu8…v41ZSummary
Lendf.me was a decentralized lending protocol built by dForce Network and launched in September 2019 as a fork of Compound v1. On April 19, 2020, an attacker exploited a reentrancy vulnerability involving ERC-777 tokens to drain approximately $25.2 million from the protocol — at the time representing 99.95% of its total value locked. The attacker returned nearly all funds within two days after inadvertently exposing identifying metadata, and the original Lendf.me contract was permanently deprecated following the incident.
Connected Entities
7 entities · 60 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- dForce Network→mentioned with→Bitcoin(75%)
- dForce Network→mentioned with→Uniswap(65%)
- dForce Network→mentioned with→Ethereum(70%)
- Lendf.me→mentioned with→Ethereum(70%)
- Lendf.me→mentioned with→Uniswap(65%)
- Lendf.me→mentioned with→Bitcoin(60%)
- Uniswap→mentioned with→Bitcoin(60%)
- dForce Lending→mentioned with→Bitcoin(75%)
- dForce Lending→mentioned with→Ethereum(65%)
- + 7 more
Timeline(9 events)
2018
Mindao Yang founds dForce Network in late 2018 as a China-based open finance protocol.
September 2019
Lendf.me lending protocol launches as a fork of Compound v1, initially supporting a limited set of Ethereum assets.
14 April 2020
dForce announces a $1.5 million strategic funding round led by Multicoin Capital, with Huobi Capital and CMBI participating.
19 April 2020
At approximately 12:58 AM UTC, attacker (EOA: 0xa9bf70a420d364e923c74448d9d817d3f2a77822) begins exploiting the ERC-777 reentrancy vulnerability. By 9:15 AM UTC+8, dForce discovers the attack. Lendf.me contracts are paused approximately one hour after the exploit begins. Approximately $25.2 million (~99.95% of TVL) is drained across 12 liquidity pools.
20 April 2020
dForce files a police report with Singapore authorities. The attacker's identifying metadata — including IP address and device fingerprint — is obtained from a CDN provider via subpoena. The attacker returns approximately $2.79 million as a first partial repayment.
21 April 2020
The attacker returns the remaining stolen funds, completing near-total restitution. dForce opens its Asset Recovery System for user withdrawals.
27 April 2020
dForce reports that over 90% of recovered assets have been redistributed to users and that 100% of affected users will be made whole.
May 2020
dForce publishes the 'Better Future' Proposal announcing 2,000,000 DF token airdrop to hack-affected users, creation of the dSAFU insurance fund with 50,000,000 DF tokens, and security improvement commitments. The original Lendf.me contract is permanently deprecated.
March 2021
Trail of Bits publishes a security audit of the redesigned dForce Lending protocol, reflecting post-incident security improvements.
Decision Log
- slot 464257237 · hash FukA21Uu8ysdqpjk3nCqRYzemuHSsqYLHeM8sTxTpHHb
- slot 464257232 · hash HWrxv2By4jBQXrtTqqN7GAbMvNkQ7fJmcq9HJ1hZCmmp
- slot 461966450 · hash BCzTkpgTo4yoAmBYHpXmy1sJAnDgkLZbL8gjXqaZA4c5
- slot 422780604 · hash 2o9JxGhJayJmNr6tKivQp5SNCEuLSUZYrYzr7qiiGGi3
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 15 of 21 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:55:00 AM
last updated: 11/1/2026, 10:18:07 PM
7 viewsavoid.net — verified advice for a post-truth world