lazarus.day
LND · 2025-05
On May 9, 2025, LNDfi suffered a \$1.27 million security breach caused by a rogue developer—later identified as an undercover North Korean IT worker—who gained unauthorized access to admin keys and drained the protocol. The attacker deployed altered smart contracts to bypass access controls and transferred funds across networks. In response, LNDfi paused its protocol, shut down its frontend, and worked with investigators like ZachXBT and SEAL to track the stolen assets and warn users. The team has offered a 15% white-hat bounty for fund recovery, reported the incident to law enforcement, and remains committed to supporting victims and restoring trust.