LND
Last changed 2026-11-03 · Fact-check review — Fact-check review (verdict: revise): the reviewer checked the page's claims against its sources; the judge moved the trust score from 12 to 0. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·AWyzzc…8sm1Summary
LND (lnd.fi) was a non-custodial, multichain DeFi lending protocol built on Sonic (a high-performance EVM chain) as a fork of Aave V3. On May 9, 2025, the protocol was drained of approximately $1.27–1.42 million by a developer who gained Pool Admin credentials and introduced a malicious access control modification 41 days before executing the exploit; the official postmortem attributed the attacker to a DPRK (North Korea) IT worker embedded in the team under false pretenses. As of mid-2025, the lnd.fi domain is no longer operated by the team and appears listed for resale, indicating the protocol ceased operations following the incident.
Connected Entities
9 entities · 60 linked investigations- LND→mentioned with→Ethereum(70%)
- LND→mentioned with→Hyperliquid(80%)
- LND→mentioned with→Binance(65%)
- LND→mentioned with→Drift(75%)
- LND→mentioned with→Bitcoin(80%)
- LND→mentioned with→ZachXBT(70%)
- Ethereum→mentioned with→Bitcoin(60%)
- ZachXBT→mentioned with→Ethereum(70%)
- ZachXBT→mentioned with→Bitcoin(65%)
- ZachXBT→mentioned with→Binance(60%)
- + 6 more
Connected Through
8 shared actors · 581 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Ethereumorganization
- □ZachXBTorganization
- ♦Bitcointoken
- □Binanceorganization
Timeline(9 events)
2025
LND.fi protocol launches on Sonic mainnet (approximate early 2025 launch date; team publicly acknowledged SonicLabs support ahead of launch)
29 March 2025
Deployer address (0xc0454e...) granted Pool Admin role on LND.fi contracts; modified AToken and VariableDebtToken contracts with backdoored access control initialized — 41 days before the exploit
5 May 2025
LND.fi goes live on Hyperliquid L1 with price feeds from Pyth Network and incentives via merkl.xyz, expanding from Sonic
9 May 2025
At 2:29 AM UTC, deployer begins draining LND.fi pools via the backdoored transferUnderlyingTo function; approximately $1.18–1.42 million stolen within minutes
9 May 2025
At 2:39 AM UTC, stolen funds bridged to wallets on BSC (~$786K) and Ethereum (~$397K, deposited to TradeOrge); ~$240K routed to MEXC via Hyperliquid
9 May 2025
At 9:19 AM UTC, Pool Admin role revoked by separate address (0xe82e...aba4); LND.fi freezes its website and revokes compromised account privileges
9 May 2025
Official postmortem published by team member 'michaelmai' on HackMD, attributing the attack to 'a developer who was actually a DPRK IT worker'
May 2025
Halborn Security publishes analysis of the LND hack as part of its May 2025 DeFi hacks review, confirming access control root cause and DPRK IT worker attribution
June 2025
lnd.fi domain no longer operated by the LND team; domain listed for sale on Nameshift.com domain marketplace, indicating apparent protocol shutdown (approximate date)
Decision Log
- slot 465082480 · hash EtZUe7tTZ1JbUDwtms2RNW9aCsBckZ2PvVuxaTQsoBzd
- slot 465082472 · hash 9wnkLpYa6NeLFhDrQCuB1iEZ23PG3tivarNfA1bDBXPZ
- slot 422575011 · hash 9AsWr1JtKKTn9cyNJYTW32oNUBAx5KigKXZk14eG18Am
This investigation is cryptographically anchored to the Solana blockchain (3 decisions). 15 of 16 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:23 AM
last updated: 11/3/2026, 11:24:37 PM
6 viewsavoid.net — verified advice for a post-truth world