LND hack — May 2025

LND (LND.fi), an Aave fork deployed on the Sonic network, was drained on 9 May 2025. The protocol's own post-mortem puts the loss at approximately $1.27 million and says the funds were taken by a developer the team had hired, whom it describes as an undercover North Korean IT worker. The mechanism was a backdoor placed in the protocol's own contracts rather than an external intrusion. The deployer published modified AToken and VariableDebtToken contracts in which the onlyPool access-control modifier was rewritten so that any address holding the Pool Admin role, not only the Pool contract itself, could call functions reserved for the pool. The deployer held that role. At 02:29:09 UTC the deployer address began calling transferUnderlyingTo and moved the pooled assets out. The altered contracts had been live and publicly visible on-chain for weeks before they were used. Proceeds were bridged off Sonic and split across wallets on BNB Chain, Ethereum and Hyperliquid, with part deposited to exchanges. The figures differ. LND's post-mortem states approximately $1.27 million. An independent analysis by Tiancheng Mai, published before LND's own account, first gave $1.27 million and was later revised to about $1.42 million on the basis of a wallet-by-wallet trace. Security firm Halborn described the loss as $1.18 million. LND paused the protocol, revoked the compromised account's privileges, said it had reported the theft to law enforcement and exchanges, and offered a 15% white-hat bounty for the return of funds. No charges or formal government attribution to North Korea have been published.