World Liberty Financial identified and blacklisted a group of user wallets holding its WLFI token that were compromised before the token’s official launch, citing phishing attacks, leaked seed phrases, and other security failures unrelated to its own systems. In an X thread posted on Wednesday, the President Trump family-affiliated company revealed that attackers gained access to wallets through external lapses tied to third-party tools or malicious schemes that tricked users into exposing private keys during its launch on September 1. The affected wallets were reportedly frozen after users reported suspicious activity, and they were asked to complete identity checks again so the company could confirm ownership and return recovered funds to the correct recipients. WLFI said it also “built and tested new smart contract logic to handle bulk reallocations,” noting that most of the compromises were caused by phishing and exposed credentials. WLFI executes emergency burn for reallocation According to the company’s statement expounding on the source of the breach, the launch of Ethereum’s EIP-7702 Pectra upgrade saw attackers placing malicious contracts into already compromised accounts, later enabling token drains once WLFI went live. 1/ Prior to WLFI’s launch, a relatively small subset of user wallets were compromised via phishing attacks or exposed seed phrases. Since then, we’ve tested new smart contract logic to safely reallocate user funds and verified users’ identity via KYC checks. Shortly, users who… — WLFI (@worldlibertyfi) November 19, 2025 World Liberty Financial froze 272 wallets affected by the breach and warned users that fake support accounts and scam recovery services were in circulation at the time. Although the number of impacted users was limited, the company insisted on stringent verification requirements to avoid sending tokens to the wrong parties. Yesterday, the Web 3 platform executed an emergency contract function that burned 166.667 million WLFI tokens, valued at about $22.14 million, from addresses involved in the hack. A market watcher going by the username Emmet Gallic shared a photo of the explanation given for the token burn function from the contract, which read: Image from token burn contract. Source: Emmett Gallic on X. WLFI confirmed from its X post that reallocations will begin shortly for wallets that have completed the required checks. Tokens belonging to users who have not yet contacted the company will be frozen until they go through the verification process, and they can start the procedure through its help center anytime until claims are resolved. “Thank you to everyone who showed patience and trust throughout this process. We’re proud to protect our community, and ready to keep building,” the platform’s social media team concluded. World Liberty Financial’s token trading opened on decentralized exchanges, dropping more than 15% shortly after going live and denting the profits of several holders like social media influencer Andrew Tate, Cryptopolitan reported . At the top of that band, the Trump family’s reported stake of 22.5 billion tokens carried a paper valuation exceeding $6 billion, per the Wall Street Journal’s feature. World Liberty Financial’s website lists Eric Trump, Donald Trump Jr., and Barron Trump as co-founders, while US President Donald Trump is noted as a “Co-Founder Emeritus.” US President Donald Trump’s ties to WLFI spark congressional probe A report by the watchdog Accountable.US said the company sold $10,000 worth of WLFI to traders who had interacted with a blockchain address now sanctioned for ties to the North Korean Lazarus hacking group. Acting on what they perceive as “actionable intel,” two US Senators have asked federal officials to examine World Liberty Financial’s activities. In a letter sent Tuesday, Senators Elizabeth Warren and Jack Reed, both members of the Senate Banking Committee, claimed WLFI is a national security risk with links to bad actors from North Korea, Russia, and Iran. The lawmakers cited the Accountable.US report, which alleged that WLFI tokens were sold to individuals tied to a sanctioned Russian ruble-based sanctions evasion network, an Iranian crypto exchange, and Tornado Cash, a service the US has sanctioned for money laundering. World Liberty Financial rejected the allegations in a statement to CNBC, saying: “There is no conflict of interest between World Liberty Financial. We conducted rigorous AML/KYC checks on every pre-sale purchaser of the $WLFI governance token and turned down millions of dollars from potential purchasers who failed the tests.” Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free .
