The Sonic-based DeFi lending protocol LNDFi fell victim to a devastating exploit on March 29, 2025, after a modified version of Aave V3 smart contracts allowed an attacker to drain approximately $1.18 million in user funds through a hidden access control backdoor.
The exploit targeted the protocol’s modified AToken and VariableDebtToken contracts, which had been deployed with a critical alteration to the onlyPool access control modifier. In standard Aave V3 deployments, this modifier restricts sensitive functions so they can only be called by the Pool contract itself. LNDFi’s version added a single clause — || aclManager.isPoolAdmin(msg.sender) — which effectively granted Pool Admin role holders the ability to invoke transferUnderlyingTo, a function normally reserved exclusively for internal protocol logic.
The Exploit Mechanics
The attack was meticulously staged over a 41-day period. On the evening of March 29, the deployer executed a sequence of transactions in just 45 seconds: assuming the Pool Admin role, deploying two modified token contracts on the Sonic blockchain, and quietly embedding the permission expansion within the code. The modifications were publicly visible on-chain, yet went undetected for over a month.
When the dormant modifications were finally activated, the attacker made repeated calls to transferUnderlyingTo, draining every liquidity pool in succession. The first withdrawal extracted $476,000 in USDC, followed by 153.7 ETH worth approximately $389,000. A third drain pulled 373,594 Wrapped Sonic tokens valued at $202,000, and a fourth removed 189,000 Beets Staked Sonic worth $105,000. A final smaller drain of 4.51 Rings scETH added roughly $11,500 to the total losses.
Blockchain investigator ZachXBT attributed the attack to a North Korean IT worker embedded within the project, a pattern that has become increasingly common in the DeFi space as state-sponsored groups target decentralized protocols with privileged access.
Affected Systems
The exploit was confined to LNDFi’s deployment on the Sonic blockchain. The protocol, which operates as a lending platform forked from Aave V3, had its core tokenization contracts compromised. The affected contract addresses include the modified AToken at 0xAA8cc9afE14f3A2B200CA25382e7C87CD883a527 and the VariableDebtToken at 0x0b1A51C5cbFfc636d79A072b8AA5a763CeC42eF2, both deployed on the Sonic network.
At the time of the exploit deployment, Bitcoin was trading at approximately $82,600 and Ethereum at $1,827, providing the pricing context for the broader market environment in which this vulnerability was planted.
The Mitigation Strategy
Following the discovery of the exploit, LNDFi posted an urgent security alert advising users to stop depositing funds into the platform. The team subsequently shut down the website entirely to prevent further deposits from users who had not yet seen the warning. Privileges assigned to the compromised account were revoked, and the protocol engaged external security teams to conduct a thorough investigation.
The LNDFi team attributed the breach to compromised private keys stolen by an outside developer, while an independent post-mortem by researcher Tiancheng Mai provided a more detailed technical breakdown of the exact code modifications that enabled the attack. The discrepancy between the official account and the forensic analysis highlights the challenges in distinguishing between negligence and deliberate insider action in DeFi exploits.
Lessons Learned
This incident reinforces several critical security principles for DeFi protocols. First, any fork of established codebases must undergo rigorous auditing to identify modifications that expand access privileges. The five-word addition to the onlyPool modifier in LNDFi’s contracts demonstrates how small code changes can have catastrophic consequences. Second, multi-signature or MPC wallet configurations should be mandatory for all deployment addresses, preventing a single compromised key from granting administrative access to core protocol functions.
Third, continuous on-chain monitoring of smart contract deployments can detect suspicious modifications before they are exploited. In this case, the backdoor was publicly visible on the Sonic blockchain for 41 days before being activated, representing a significant window during which automated monitoring tools could have raised an alert.
User Action Required
Users who had funds deposited in LNDFi on the Sonic blockchain should monitor the protocol’s official channels for updates on fund recovery efforts. Anyone interacting with forked DeFi protocols should verify that the contracts have been audited by reputable security firms and that administrative functions are protected by multi-signature wallets rather than single private keys. The broader DeFi community should treat this incident as a case study in the risks of unaudited code modifications to established protocol architectures.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before interacting with any DeFi protocol.
a single clause in a modifier and $1.18m gone. this is why you dont fork Aave and wing it
41 days of staging. attacker was patient, almost impressive if it wasnt so damaging
the specific change was adding aclManager.isPoolAdmin on the onlyPool modifier. one line and it bypasses the entire access control model. forking without understanding every modifier is playing with fire
one line change and $1.18m gone. the diff between forking safely and forking dangerously is understanding every single modifier you touch
forking aave v3 without understanding the modifier architecture is like performing surgery with a blindfold. the vulnerability was self-inflicted
aclManager backdoor is basically an insider red flag. was this audited at all?
sonic network is still new enough that audit coverage is thin. fork auditors check the diff, not the whole contract. this exploit was in the diff