Seedify hack — September 2025

At about 12:05 UTC on 23 September 2025 an attacker minted unbacked SFUND tokens through Seedify's cross-chain bridge and sold them into liquidity pools on several networks. Seedify, a blockchain gaming launchpad, said the attacker had obtained a developer's private key that carried owner rights over its LayerZero OFT bridge contract on Avalanche. The entry point was the key rather than a code defect; the team said the bridge contracts had previously passed audits.

With owner access the attacker altered the contract's configuration and minted roughly 8.79 million SFUND, then bridged the tokens to Ethereum, Arbitrum, Base and BNB Chain and sold them. SFUND's price collapsed by close to 99 percent before partially recovering.

The loss has been reported at two levels. Contemporaneous reporting by crypto.news and others put the value taken from liquidity at more than $1.2 million and counted about 64,000 affected SFUND holders on BNB Chain. Other outlets cite roughly $1.7 million across all chains without identifying who produced that estimate or how it was reached. Neither figure has been reconciled and Seedify did not publish an itemised accounting.

Seedify disabled its bridges, blacklisted the attacker's addresses and asked exchanges to halt trading. Changpeng Zhao said security contacts helped freeze about $200,000 at HTX; the remainder stayed on-chain. The on-chain investigator ZachXBT tied the addresses to the North Korean "Contagious Interview" cluster, and Seedify's founder publicly blamed DPRK-affiliated attackers. That attribution rests on researcher analysis and the company's own claim, not on charges or a government finding.