Skip to main content
AVOID.NET
Sign in

LND

avoid.net/lnd→12/100·78% conf.
[AI-DRAFTED · AWAITING VERIFICATION][src:defillama]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·AWyzzc…8sm1

Summary

LND (lnd.fi) was a non-custodial, multichain DeFi lending protocol built on Sonic (a high-performance EVM chain) as a fork of Aave V3. On May 9, 2025, the protocol was drained of approximately $1.27–1.42 million by a developer who gained Pool Admin credentials and introduced a malicious access control modification 41 days before executing the exploit; the official postmortem attributed the attacker to a DPRK (North Korea) IT worker embedded in the team under false pretenses. As of mid-2025, the lnd.fi domain is no longer operated by the team and appears listed for resale, indicating the protocol ceased operations following the incident.

Connected Entities

9 entities · 60 linked investigations
Organizations
□Aave74□Ethereum64□Drift□Binance□LND□ZachXBT□Hyperliquid
Protocols
⌂Drift Protocol
Tokens
♦Bitcoin
Relationships
  • LND→mentioned with→Ethereum(70%)
  • LND→mentioned with→Hyperliquid(80%)
  • LND→mentioned with→Binance(65%)
  • LND→mentioned with→Drift(75%)
  • LND→mentioned with→Bitcoin(80%)
  • LND→mentioned with→ZachXBT(70%)
  • Ethereum→mentioned with→Bitcoin(60%)
  • ZachXBT→mentioned with→Ethereum(70%)
  • ZachXBT→mentioned with→Bitcoin(65%)
  • ZachXBT→mentioned with→Binance(60%)
  • + 6 more
Also appears in
Edel Finance·28KelpDAO Bridge Exploit (April 2026)·18Arbitrum·52Aave·74Dough Finance·12World Liberty Financial (WLFI)·22Ankr (ankrFLOW Collateral Exploit)·38Ethereum·64Tender Finance·32Lendf.me·30+ 50 more
Have evidence about LND?

Timeline(9 events)

2025

LND.fi protocol launches on Sonic mainnet (approximate early 2025 launch date; team publicly acknowledged SonicLabs support ahead of launch)

29 March 2025

Deployer address (0xc0454e...) granted Pool Admin role on LND.fi contracts; modified AToken and VariableDebtToken contracts with backdoored access control initialized — 41 days before the exploit

5 May 2025

LND.fi goes live on Hyperliquid L1 with price feeds from Pyth Network and incentives via merkl.xyz, expanding from Sonic

9 May 2025

At 2:29 AM UTC, deployer begins draining LND.fi pools via the backdoored transferUnderlyingTo function; approximately $1.18–1.42 million stolen within minutes

9 May 2025

At 2:39 AM UTC, stolen funds bridged to wallets on BSC (~$786K) and Ethereum (~$397K, deposited to TradeOrge); ~$240K routed to MEXC via Hyperliquid

9 May 2025

At 9:19 AM UTC, Pool Admin role revoked by separate address (0xe82e...aba4); LND.fi freezes its website and revokes compromised account privileges

9 May 2025

Official postmortem published by team member 'michaelmai' on HackMD, attributing the attack to 'a developer who was actually a DPRK IT worker'

May 2025

Halborn Security publishes analysis of the LND hack as part of its May 2025 DeFi hacks review, confirming access control root cause and DPRK IT worker attribution

June 2025

lnd.fi domain no longer operated by the LND team; domain listed for sale on Nameshift.com domain marketplace, indicating apparent protocol shutdown (approximate date)

Provenance & Audit Trail
Anchored on SolanaVerify on-chain15 Wayback Archivessrc:defillama

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (1 event). 15 of 16 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-sonnet-4-6

generated: 5/4/2026, 2:54:23 AM

last updated: 8/29/2026, 6:16:46 PM

5 views

avoid.net — verified advice for a post-truth world