World Liberty Financial said hackers infiltrated its ecosystem on February 23, with its flagship stablecoin USD1 at the center of the operation. The attack was described as a coordinated effort built to push the token off its dollar peg and profit from the disruption. According to the platform, the playbook combined false messaging, amplified panic, and short positions tied to the wider ecosystem.
Compromised social accounts were used to spread false claims
The protocol said attackers first used hacked social media accounts belonging to co-founders to publish fabricated information. The goal was to trigger fear, uncertainty, and doubt around USD1 and the platform itself. After that, the attackers reportedly paid crypto influencers to magnify the story and make the incident appear more severe than it was. They then moved to short WLFI tokens, seeking to convert the confusion into trading gains. The pressure was real, if brief.
USD1 dipped 0.6% before recovering near parity
World Liberty Financial said the effort failed because of USD1’s mint-and-redeem structure and its full 1:1 backing. During the episode, the stablecoin fell to $0.994, a temporary deviation of about 0.6% from its peg, before rebounding close to $1. At press time, USD1 was trading at $0.9989, down 0.28% over 24 hours. The WLFI token changed hands at $0.1115, showing a 0.7% daily decline, and was ranked 29th by market capitalization.
The platform said its model follows the fully reserved, fiat-backed mint-and-redeem design used by a number of other stablecoin issuers. It pointed to monthly reserve attestations, reserve composition reports, institutional partnerships, and its white paper, called the “Gold Paper,” as support for that claim.
Fourth attack linked to the platform in two years
World Liberty Financial said this was the fourth attack aimed at the platform over the last two years. In July 2024, Dough Finance, a previous project related to the DeFi platform, lost $2.5 million to hackers. In September 2025, “sweeper bots” exploited a vulnerability tied to Ethereum’s EIP-7702 upgrade, draining wallets of millions of dollars in WLFI tokens. Two months later, a phishing campaign compromised user wallets, and the platform said it had to burn and reallocate $22 million worth of stolen tokens.
Alongside those security incidents, the project also launched the World Liberty Forum. The initiative, according to the report, is intended to take part in discussions around cryptocurrency regulation.