Trump-backed World Liberty Financial reallocates funds following 'third-party security lapses'

World Liberty Financial, facing congressional scrutiny over alleged token sales to entities in sanctioned regions including North Korea, Russia, and Iran, said Wednesday it is working to "reallocate user funds and verified users' identity via KYC checks" following potential breaches.

In an X post, the Trump-connected project said that a "relatively small subset of user wallets were compromised via phishing attacks or exposed seed phrases" due to "third-party security lapses." The project is now testing new smart contract logic to safeguard these accounts.

"Users who submitted tickets and satisfied the required checks will have funds reallocated to new, secure wallets," World Liberty wrote. "In September, we froze impacted wallets and verified ownership to ensure a smooth transition."

It is unclear how many users were affected or the total amount of funds at risk. World Liberty noted that the issue "was not a WLFI platform or smart contract issue."

“Even with issues stemming from external vulnerabilities, the team prioritized the security of its users while meeting regulatory requirements,” World Liberty added. 

Sanctioned sales?

Earlier this week, Senators Elizabeth Warren, D-Mass, and Jack Reed, D-R.I., called upon the Departments of Justice and Treasury to investigate alleged WLF token sales to sanctioned entities, citing a September report from Accountable.US, according to CNBC on Tuesday.

The “suspicious” transactions reportedly involved North Korean hacking group Lazarus, a sanctioned Russian “ruble-backed sanctions evasion tool,” and an Iranian crypto exchange, the watchdog claimed.

It is unclear whether World Liberty’s announcement on Wednesday is connected to Warren and Reed’s letter. This is not the first time that World Liberty — which names Eric Trump, Donald Trump Jr., and Barron Trump as co-founders — has raised concerns among congressmembers, who have raised concerns of potential conflicts of interest.

Of note, several blockchain security experts, including Taylor Moynahan, security lead at Ethereum's largest wallet, MetaMask, and Nick Bax, founder of Ump.eth, challenged some of the onchain analysis performed by Accountable that purportedly connected an address to Lazarus.

"TL/DR: someone wrote 14 pages about Lazarus based on a funky shitcoin token transfer," Bax wrote. "The worst part of this all (other than my Senator disseminating disinfo), is Shryder wasn't just falsely accused of being a DPRK hacker; it appears his big bag WLFI tokens (~$95k) got frozen as a result of this false positive."