World Liberty Financial has taken swift action after discovering that several wallets were compromised before the project officially launched. In an effort to protect users and recover stolen funds, the team carried out a major burn-and-reallocation process involving $22.1 million worth of WLFI tokens.
The Trump-affiliated crypto project revealed the recovery operation in a Nov. 19 announcement on X, and blockchain data later verified the move.
How the breach happened
According to WLFI, a subset of user wallets was compromised through phishing attacks and leaked seed phrases prior to launch. Importantly, the team emphasized that these issues did not stem from flaws in WLFI’s own smart contracts but rather from third-party security failures and user-level exploits.
Back in September, WLFI froze all affected wallets, asked users to re-complete KYC checks, and began gathering new secure wallet addresses for those impacted.
The $22.1M burn-and-reallocate process
After building and testing new smart contract logic to safely transfer funds, the team initiated a controlled recovery function on Nov. 19. This function burned 166.667 million WLFI worth about $22.14 million directly from compromised wallets. The exact same amount was then issued to verified users’ new wallets.
On-chain analyst Emmett Gallic confirmed the details, noting that the emergency recovery function was originally designed for two situations:
- When an investor loses access to their wallet before their tokens vest
- When tokens fall into the hands of malicious actors through an exploit
WLFI says it took a slow and cautious approach to avoid errors while handling users’ funds. Verified users will receive their reallocated tokens in their new wallets, while wallets belonging to unverified users will remain frozen until they complete the official recovery process through WLFI’s help center.
What caused the wallet compromises?
Most of the affected wallets were hit by phishing schemes or exposed private keys. Some incidents were also linked to the EIP-7702 vulnerabilities seen during Ethereum’s Pectra upgrade in September, where attackers used malicious contracts embedded in compromised wallets to trigger automated token drains later on.
WLFI previously froze 272 wallets and warned users repeatedly about fake support accounts and impersonation scams. While the number of affected users remains small, the team insisted on strict KYC and verification to ensure funds are returned to the rightful owners.
Ongoing political pressure
The recovery comes at a sensitive time for World Liberty Financial. Earlier this week, U.S. Senators Elizabeth Warren and Jack Reed requested that regulators investigate claims that WLFI tokens may have been sold to sanctioned entities.
WLFI has not responded publicly to these political concerns, but the team says it remains focused on development, including its upcoming USD1 stablecoin and various ecosystem integrations.
With the recovery operation now behind them, the project says it is ready to move forward and continue building.
