Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #1[disputed][awaiting moderator]in section: May 2025 Hack: DPRK Insider Exploit

   “The official postmortem, authored by a team member identified as 'michaelmai' on HackMD, stated that 'the attack was carried out by a developer who was actually a DPRK IT worker.'”

   reviewerThe official postmortem was authored by a team member named michaelmai on HackMD and contains the DPRK quoteThe DPRK attribution exists via Halborn's description of LND's postmortem, but the cited HackMD page is not the team's official postmortem and does not contain the quote. The source is mislabeled.
   Proposed correction (not yet applied)

   LND's own postmortem, as quoted by Halborn, attributed the attack to a developer who was actually a DPRK IT worker. The HackMD page by 'michaelmai' that the page cites is a separate analysis whose author disputes LND's postmortem, and it does not mention DPRK.
   citedhackmd.io/@michaelmai/LND-Postmortem
2. #3[disputed][awaiting moderator]in section: May 2025 Hack: DPRK Insider Exploit

   “Total losses across independent assessments ranged from $1.18 million (Halborn) to $1.42 million (DeFiHackLabs postmortem).”

   reviewerTotal losses ranged from $1.18M (Halborn) to $1.42M (DeFiHackLabs postmortem)The $1.42M figure is attributed to the wrong source. It comes from the HackMD page.
   Proposed correction (not yet applied)

   Total loss estimates ranged from $1.18 million (Halborn) to $1.27 million (DeFiHackLabs), with a later HackMD analysis by 'michaelmai' revising the figure to $1.42 million.
   citeddefihacklabs.substack.com/p/lnd-postmort…127-million-loss

No source the reviewer could reach confirms or contradicts the claim.

1. #7[unverifiable][awaiting moderator]in section: Access Control Vulnerability: Technical Analysis

   “Security analysts at Halborn noted that multi-signature wallet controls over deployment keys, and automated on-chain monitoring for unauthorized contract modifications, could have prevented or significantly limited the attack.”

   reviewerHalborn noted multisig and on-chain monitoring could have prevented the attackNot seen in the fetched Halborn content. The summarizer may have dropped it.
   citedwww.halborn.com/blog/post/explained-the-lnd-hack-may-2025
2. #8[unverifiable][awaiting moderator]in section: Protocol Status Post-Hack

   “ZachXBT flagged LND as a risk entity; however, specific public ZachXBT posts or threads dedicated to LND.fi have not been located in open-source reporting at this time.”

   reviewerZachXBT flagged LND as a risk entityNo source found and none cited. The sentence admits no posts were located, so the 'flagged' assertion is unsupported. Consider removing it.
3. #9[unverifiable][awaiting moderator]in section: Protocol Status Post-Hack

   “appears to be listed for sale via a domain marketplace (Nameshift.com)”

   reviewerlnd.fi domain listed for sale on Nameshift.com in mid-2025No cited source. I did not fetch the domain, and the claim is time-bound to mid-2025.
4. #10[unverifiable][awaiting moderator]in section: DPRK IT Worker Context

   “which also allegedly includes the $285 million Drift Protocol exploit attributed (with medium confidence by Mandiant) to the DPRK-linked group UNC4736”

   reviewerDrift Protocol exploit attributed to UNC4736 with medium confidence by MandiantThe Hacker News article was not fetched, for time. The Drift link to LND-style IT-worker insider attacks is loose.
   citedthehackernews.com/2026/04/285-million-dr…aced-to-six.html

The cited evidence supports part of the claim but not all of it.

1. #2[partially supported][awaiting moderator]in the summary

   “the official postmortem attributed the attacker to a DPRK (North Korea) IT worker embedded in the team under false pretenses”

   reviewerDPRK attribution (summary): official postmortem attributed the attacker to a DPRK IT workerThe attribution is reported by Halborn. The 'embedded in the team under false pretenses' wording is not in the sources I could read. The body already notes the attribution is uncorroborated.
   citedwww.halborn.com/blog/post/explained-the-lnd-hack-may-2025

The cited evidence supports the claim as written.

1. #4[confirmed][no action needed]in section: May 2025 Hack: DPRK Insider Exploit

   “The deployer had been granted the Pool Admin role on March 29, 2025, at 9:51 PM UTC, and immediately initialized modified AToken and VariableDebtToken contracts.”

   reviewerBackdoor inserted 41 days earlier, Pool Admin granted March 29, 2025 at 9:51 PM UTCTimestamps match. The '41 days' figure is Halborn's and the DeFiHackLabs timestamps imply about 40 days. Immaterial.
   citeddefihacklabs.substack.com/p/lnd-postmort…127-million-loss
2. #5[confirmed][no action needed]in section: May 2025 Hack: DPRK Insider Exploit

   “At 9:19 AM UTC on May 9, a separate address (0xe82e...aba4) revoked the Pool Admin role from the deployer.”

   reviewerDrain began 2:29 AM UTC May 9; role revoked 9:19 AM UTC by 0xe82e...aba4Confirmed.
   citeddefihacklabs.substack.com/p/lnd-postmort…127-million-loss
3. #6[confirmed][no action needed]in section: Fund Movement and On-Chain Forensics

   “Approximately $397,000 was sent to an Ethereum address and subsequently deposited to TradeOrge. Approximately $240,000 was bridged to MEXC via Hyperliquid.”

   reviewerFund movement: ~$786K BSC, ~$397K Ethereum to TradeOrge, ~$240K to MEXC via HyperliquidETH and MEXC figures match. The BSC total of $786K was not directly verifiable.
   citedhackmd.io/@michaelmai/LND-Postmortem