Donald Trump-backed World Liberty Financial (WLFI) has revealed that the wallets of multiple users were compromised before the project went live in September. The team behind the token is not sure whether the breach was a result of a phishing attack or were the private seed phrases to the impacted wallets exposed online.
WLF disclaimed any responsibility for being a point of initiation for the breach through a detailed post on X shared on Thursday, November 20. It blamed third-party security lapses for giving cyber actors the access to internal data. While WLFI does not offer proprietary wallets, it allows integration with multiple third-party wallet providers.
As a precautionary measure, WLF said it froze the impacted wallets and had the impacted users re-fill their KYC details to confirm identities and issue new wallets.
“We built and tested new smart contract logic to handle bulk reallocations, ensuring WLFI users remain protected. This process took time, but prioritizing safety of funds was paramount over speed. Even with issues stemming from external vulnerabilities, the team prioritized the security of its users while meeting regulatory requirements,” the official X handle of the project posted on X.
Shortly after WLF said it will be reallocating funds to the impacted wallets, on-chain data security Arkham said that the company has moved to burn $221.14 million worth of WLFI tokens. At the time of writing, this native token of the project is trading at $0.1410 as per CoinMarketCap.
This could indicate that the breach could have cost WLF above or around $221 million – a detail that the company has decided to not disclose.
WLF’s native WLFI token stepped into its trading phase between August and September this year. At the time, 99.94 percent token holders had voted in favour of having the token released into the market.
A few days later, Tron founder Justin Sun claimed that his WLFI tokens were unexplainably frozen. It could be likely that Sun’s WLFI wallet was also among the compromised ones.
More details on the development remains awaited for now. The exact number of wallets compromised and the exact value lost in the breach remains undisclosed.