Audit log

Every state-changing event for LND: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-27 20:30:06Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,575,011

   sig

   AWyzzcvAZNcU…wx1t8sm1copyexplorer ↗

   hash

   9AsWr1JtKKTn…14eG18Amcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (7434 B) ▸

   {"actor":"system:backfill","investigation_id":"2f7c30c1-4224-4431-b322-5be4c94348e6","kind":"publish","page_slug":"lnd","published_at":"2026-05-27T20:30:06.405Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"LND","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":2,"name":"Explained: The LND Hack (May 2025) — Halborn Security","type":"research","url":"https://www.halborn.com/blog/post/explained-the-lnd-hack-may-2025"},{"credibility":2,"name":"LND Protocol — DefiLlama","type":"on_chain","url":"https://defillama.com/protocol/lnd"},{"credibility":2,"name":"LND Postmortem: $1.27 Million Loss — DeFiHackLabs / SunSec (Substack)","type":"research","url":"https://defihacklabs.substack.com/p/lnd-postmortem-127-million-loss"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":2,"name":"LND Postmortem — HackMD (official team postmortem by michaelmai)","type":"official","url":"https://hackmd.io/@michaelmai/LND-Postmortem"},{"credibility":2,"name":"LND Postmortem: $1.27 Million Loss — DeFiHackLabs / SunSec","type":"research","url":"https://defihacklabs.substack.com/p/lnd-postmortem-127-million-loss"},{"credibility":2,"name":"Explained: The LND Hack (May 2025) — Halborn Security","type":"research","url":"https://www.halborn.com/blog/post/explained-the-lnd-hack-may-2025"},{"credibility":2,"name":"Month in Review: Top DeFi Hacks of May 2025 — Halborn","type":"research","url":"https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-may-2025"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":2,"name":"Explained: The LND Hack (May 2025) — Halborn Security","type":"research","url":"https://www.halborn.com/blog/post/explained-the-lnd-hack-may-2025"},{"credibility":2,"name":"LND Postmortem: $1.27 Million Loss — DeFiHackLabs / SunSec","type":"research","url":"https://defihacklabs.substack.com/p/lnd-postmortem-127-million-loss"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":2,"name":"LND Postmortem — HackMD","type":"official","url":"https://hackmd.io/@michaelmai/LND-Postmortem"},{"credibility":2,"name":"LND Postmortem: $1.27 Million Loss — DeFiHackLabs / SunSec","type":"research","url":"https://defihacklabs.substack.com/p/lnd-postmortem-127-million-loss"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":2,"name":"LND Protocol — DefiLlama TVL data","type":"on_chain","url":"https://defillama.com/protocol/lnd"},{"credibility":2,"name":"Explained: The LND Hack (May 2025) — Halborn Security","type":"research","url":"https://www.halborn.com/blog/post/explained-the-lnd-hack-may-2025"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":2,"name":"ZachXBT uncovers North Korea-linked IT worker network — The Block","type":"news_article","url":"https://www.theblock.co/post/396847/zachxbt-uncovers-north-korea-linked-it-worker-network-generating-1m-monthly-via-crypto-payment-flows"},{"credibility":1,"name":"DPRK IT Workers — FBI Advisory","type":"regulatory","url":"https://www.fbi.gov/wanted/cyber/dprk-it-fraud"},{"credibility":2,"name":"North Korea IT Workers: Inside the DPRK's Crypto Laundering Network — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/dprk-it-workers-north-korea-crypto-laundering-networks/"},{"credibility":2,"name":"$285 Million Drift Hack Traced to Six-Month DPRK Social Engineering Operation — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/04/285-million-drift-hack-traced-to-six.html"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":1,"name":"Lendingblock (LND) Token Tracker — Etherscan","type":"on_chain","url":"https://etherscan.io/token/0x0947b0e6d821378805c9598291385ce7c791a6b2"},{"credibility":2,"name":"10 Questions For The Founders Of Lendingblock — The Fintech Times","type":"news_article","url":"https://thefintechtimes.com/lending-platform-lendingblock-2/"},{"credibility":2,"name":"Lendingblock 2.0 — Medium (official blog)","type":"official","url":"https://medium.com/lendingblock/lendingblock-2-0-7b333415bb58"},{"credibility":2,"name":"Lendingblock price today — CoinMarketCap","type":"other","url":"https://coinmarketcap.com/currencies/lendingblock/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":2,"name":"Bitcoin Lightning bug allows remote theft of bitcoin via LND nodes — Protos","type":"news_article","url":"https://protos.com/bitcoin-lightning-bug-allows-remote-theft-of-bitcoin-via-lnd-nodes/"},{"credibility":1,"name":"CVE-2024-38359: Lightning Network Daemon (LND) onion processing DoS — GitLab Advisory Database","type":"other","url":"https://advisories.gitlab.com/pkg/golang/github.com/lightningnetwork/lnd/CVE-2024-38359/"},{"credibility":1,"name":"Lightning Network Daemon — GitHub (Lightning Labs)","type":"official","url":"https://github.com/lightningnetwork/lnd"}]}],"sources_used":[],"summary":"LND (lnd.fi) was a non-custodial, multichain DeFi lending protocol built on Sonic (a high-performance EVM chain) as a fork of Aave V3. On May 9, 2025, the protocol was drained of approximately $1.27–1.42 million by a developer who gained Pool Admin credentials and introduced a malicious access control modification 41 days before executing the exploit; the official postmortem attributed the attacker to a DPRK (North Korea) IT worker embedded in the team under false pretenses. As of mid-2025, the lnd.fi domain is no longer operated by the team and appears listed for resale, indicating the protocol ceased operations following the incident.","timeline":[{"date":"2025-01-01","event":"LND.fi protocol launches on Sonic mainnet (approximate early 2025 launch date; team publicly acknowledged SonicLabs support ahead of launch)","source":""},{"date":"2025-03-29","event":"Deployer address (0xc0454e...) granted Pool Admin role on LND.fi contracts; modified AToken and VariableDebtToken contracts with backdoored access control initialized — 41 days before the exploit","source":""},{"date":"2025-05-05","event":"LND.fi goes live on Hyperliquid L1 with price feeds from Pyth Network and incentives via merkl.xyz, expanding from Sonic","source":""},{"date":"2025-05-09","event":"At 2:29 AM UTC, deployer begins draining LND.fi pools via the backdoored transferUnderlyingTo function; approximately $1.18–1.42 million stolen within minutes","source":""},{"date":"2025-05-09","event":"At 2:39 AM UTC, stolen funds bridged to wallets on BSC (~$786K) and Ethereum (~$397K, deposited to TradeOrge); ~$240K routed to MEXC via Hyperliquid","source":""},{"date":"2025-05-09","event":"At 9:19 AM UTC, Pool Admin role revoked by separate address (0xe82e...aba4); LND.fi freezes its website and revokes compromised account privileges","source":""},{"date":"2025-05-09","event":"Official postmortem published by team member 'michaelmai' on HackMD, attributing the attack to 'a developer who was actually a DPRK IT worker'","source":""},{"date":"2025-05-01","event":"Halborn Security publishes analysis of the LND hack as part of its May 2025 DeFi hacks review, confirming access control root cause and DPRK IT worker attribution","source":""},{"date":"2025-06-01","event":"lnd.fi domain no longer operated by the LND team; domain listed for sale on Nameshift.com domain marketplace, indicating apparent protocol shutdown (approximate date)","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 383b76c9-0523-4c5d-ad7d-136149585b23copy
2. #2reviewby reviewerreviewer

   2026-11-03 23:24:36Z
   Score: 12 → 12 (no score change)
   The core incident (May 9, 2025 exploit via a modified onlyPool modifier, Pool Admin timeline, fund flows to TradeOrge and MEXC) matches the DeFiHackLabs and HackMD analyses. Two errors affect source attribution. The HackMD page is labeled the team's official postmortem and quoted for a DPRK statement, but it is an independent analysis with no DPRK mention. The $1.42M loss figure is credited to DeFiHackLabs, which says $1.27M. Several secondary claims (ZachXBT flag, Nameshift listing, Halborn recommendations, Drift attribution detail) were not verified.
   anchoranchored

   chain

   ●mainnet-betaslot 465,082,472

   sig

   3buhV5EKD8UX…kEwzRZfXcopyexplorer ↗

   hash

   9wnkLpYa6NeL…A1bDBXPZcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1398 B) ▸

   {"actor":"reviewer","artifact_identity":"abb4048e0d77ab77c7d2126ed1a8bd4e","decided_at":"2026-11-03T23:24:36.485Z","decision":"review","disputed_pct":0.6,"findings_hash":"8BJgXKx9XLBKi1XMr8G1zud2teQ1kbT6nmG6carAM2wX","investigation_id":"2f7c30c1-4224-4431-b322-5be4c94348e6","judge_def_hash":"750934ecb48272224909b7430fab271676d391380fbc821acbe7ee7e4cac2fa3","new_score":12,"omissions":{"material":0,"total":1},"page_content_hash":"b48858d508c12d3709edc26bf8d56a8abe5b1d20f1d1c16c9e20c8068de71292","page_slug":"lnd","prev_score":12,"reason":"The core incident (May 9, 2025 exploit via a modified onlyPool modifier, Pool Admin timeline, fund flows to TradeOrge and MEXC) matches the DeFiHackLabs and HackMD analyses. Two errors affect source attribution. The HackMD page is labeled the team's official postmortem and quoted for a DPRK statement, but it is an independent analysis with no DPRK mention. The $1.42M loss figure is credited to DeFiHackLabs, which says $1.27M. Several secondary claims (ZachXBT flag, Nameshift listing, Halborn recommendations, Drift attribution detail) were not verified.","reviewer_def_hash":"3839668b232611e5b26db72079d64745f8e57e919b8a379e79b44ba4a52c845b","score_delta":0,"sequence_num":2,"subject_status":"shut_down","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ff4f490f-0789-4fa2-9516-cf7eab320541copy
3. #3review reviseby judgejudge

   2026-11-03 23:24:36Z
   Score: 12 → 0 (-25)
   Of 10 claims checked, 2 were disputed (claim_findings[0], [2]) and 4 could not be verified (claim_findings[6]-[9]), giving 60% by count. The disputes are real: a HackMD page by an independent analyst is labeled the team's official postmortem and quoted for a DPRK statement it does not contain, and the $1.42M loss figure is credited to the wrong source. We did not apply the 'failed factcheck' band because the core incident (exploit timeline, Pool Admin dates, fund flows) was confirmed (claim_findings[3]-[5]), none of the unverifiable items was contradicted (the reviewer did not fetch some sources, and a fetch summary may have missed one passage), and reviewer confidence was moderate at 0.6. The page stays under investigation until it cites LND's primary postmortem, which is the only basis of the DPRK attribution (high-priority coverage gap), and fixes the source labels.
   anchoranchored

   chain

   ●mainnet-betaslot 465,082,480

   sig

   3Y2dBWC3nDjv…KcEPp9QMcopyexplorer ↗

   hash

   EtZUe7tTZ1Jb…aTQsoBzdcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (2651 B) ▸

   {"actor":"judge","artifact_identity":"abb4048e0d77ab77c7d2126ed1a8bd4e","band_override":{"actual_delta":-25,"actual_verdict":"review_revise","disputed_pct":0.6,"expected_delta_range":[-50,-30],"expected_verdict":"review_deny","rationale":"Of 10 claims checked, 2 were disputed (claim_findings[0], [2]) and 4 could not be verified (claim_findings[6]-[9]), giving 60% by count. The disputes are real: a HackMD page by an independent analyst is labeled the team's official postmortem and quoted for a DPRK statement it does not contain, and the $1.42M loss figure is credited to the wrong source. We did not apply the 'failed factcheck' band because the core incident (exploit timeline, Pool Admin dates, fund flows) was confirmed (claim_findings[3]-[5]), none of the unverifiable items was contradicted (the reviewer did not fetch some sources, and a fetch summary may have missed one passage), and reviewer confidence was moderate at 0.6. The page stays under investigation until it cites LND's primary postmortem, which is the only basis of the DPRK attribution (high-priority coverage gap), and fixes the source labels."},"decided_at":"2026-11-03T23:24:36.485Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.6,"investigation_id":"2f7c30c1-4224-4431-b322-5be4c94348e6","judge_def_hash":"750934ecb48272224909b7430fab271676d391380fbc821acbe7ee7e4cac2fa3","new_score":0,"page_slug":"lnd","prev_score":12,"reason":"Of 10 claims checked, 2 were disputed (claim_findings[0], [2]) and 4 could not be verified (claim_findings[6]-[9]), giving 60% by count. The disputes are real: a HackMD page by an independent analyst is labeled the team's official postmortem and quoted for a DPRK statement it does not contain, and the $1.42M loss figure is credited to the wrong source. We did not apply the 'failed factcheck' band because the core incident (exploit timeline, Pool Admin dates, fund flows) was confirmed (claim_findings[3]-[5]), none of the unverifiable items was contradicted (the reviewer did not fetch some sources, and a fetch summary may have missed one passage), and reviewer confidence was moderate at 0.6. The page stays under investigation until it cites LND's primary postmortem, which is the only basis of the DPRK attribution (high-priority coverage gap), and fixes the source labels.","reviewer_def_hash":"3839668b232611e5b26db72079d64745f8e57e919b8a379e79b44ba4a52c845b","score_delta":-25,"score_limit":{"applied":-25,"limited":false,"proposed":-25,"rule":"second_opinion_agreed","second":-28},"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 96f107c9-ca3d-4d53-a84c-abbc4e9a8623copy