LNDFi Loses $1.18 Million to a Backdoor That Sat Dormant for 41 Days

A modified admin function on the Sonic-based lending protocol LNDFi allowed an attacker to withdraw roughly $1.18 million from the platform on May 9, 2025. The mechanism behind the loss was not a novel exploit technique but a single altered line inside a customized Aave fork — one that had sat untouched inside the protocol for nearly a month and a half before it was used.

According to an independent technical review published by researcher Tiancheng Mai, the backdoor originated on March 29, 2025, when the protocol's deployer wallet — 0xc0454e29835479ee80d6f42965a16dcee9bfd868 — was granted the Pool Admin role in a transaction that took place within roughly 45 seconds that evening. In the same window, two modified token contracts were deployed: an altered AToken contract at 0xAA8cc9afE14f3A2B200CA25382e7C87CD883a527 and an altered VariableDebtToken contract at 0x0b1A51C5cbFfc636d79A072b8AA5a763CeC42eF2.

In a standard Aave V3 deployment, the onlyPool modifier guarding the sensitive transferUnderlyingTo function consists of a single check — require(_msgSender() == address(POOL)) — limiting the call strictly to the protocol's own internal pool logic. LNDFi's deployed contracts added a second condition to that same modifier: || aclManager.isPoolAdmin(msg.sender). That five-word addition meant anyone holding the Pool Admin role — not only the protocol's own logic — could call transferUnderlyingTo and move user funds directly out of the pools.

The change went unused for 41 days. Then, at 2:29 AM UTC on May 9, repeated calls to transferUnderlyingTo began systematically emptying LNDFi's pools, routing funds to a wallet at 0x5149A7696188F083297281D10293a20476252CDD. Five separate withdrawals were recorded:

• $476,000 in USDC — transaction
• 153.7 ETH, roughly $389,000 — transaction
• 373,594 Wrapped Sonic, roughly $202,000 — transaction
• 189,000 Beets Staked Sonic, roughly $105,000 — transaction
• 4.51 Rings scETH, roughly $11,500 — transaction

Combined, the five withdrawals totaled approximately $1,183,500. Within ten minutes the stolen assets were already moving across bridges toward Ethereum and BSC. LNDFi's Admin rights were not revoked until 9:19 AM UTC that day — nearly seven hours after the draining began — in this transaction. LNDFi has said most of the stolen funds were subsequently routed to wallets on Ethereum (0x5a94a3a1..., 0x2446f952...) and on BSC (0x4b82e348..., 0x8148c424..., 0x82be4fe8...).

LNDFi's team first signaled trouble as activity spiked on the Sonic chain that day. An initial post from the project read: "We have detected a security issue on our platform. Please do NOT deposit into the platform it has been compromised. We are in talks with security teams to look into it further." A follow-up statement the next day added: "We are temporarily shutting down the website as people are still depositing." Researcher Tiancheng Mai then published an unofficial technical breakdown of the exploit mechanics in a linked post-mortem document.

Two days after the drain, LNDFi released its own official post-mortem, attributing the incident to a state-sponsored infiltrator rather than to the contract modification itself: "The incident was traced to a developer unknowingly hired by the team who turned out to be an undercover DPRK IT worker. This individual/team unlawfully accessed the project's administrative keys and executed a series of unauthorized transactions." Investigator ZachXBT lent support to that account, stating: "I helped initially attribute the incident to DPRK IT workers and flagged theft addresses," while separately clarifying that he was "not formally engaged nor creating an investigative report for them."

The official account does not explain why the backdoor was inserted six weeks before it was exploited, why the Pool Admin role was granted and revoked as it was, or why a multisig arrangement was not used to protect such a sensitive privilege. The unofficial post-mortem, by contrast, documents the exact contract addresses and code lines where the privilege escalation occurred, and frames the sequence — role grant, contract deployment, a 41-day dormant period, then a coordinated draining — as consistent with a planned extraction rather than an ad hoc compromise. Whether or not the DPRK attribution holds up, the underlying cause is unchanged: a single admin-controlled condition, inserted into a core access check, gave one role holder the power to empty every pool in the protocol.