Skip to main content
• 2 min read

USD1 Faces a
Coordinated Short-Selling Attack

An in-depth review of the coordinated short-selling attack on the WLFI ecosystem stablecoin, USD1. Attackers compromised founder accounts and manipulated KOLs to spread FUD and execute malicious short-selling. Explore how Web3 teams can enhance OPSEC and threat intelligence via AutoSec.

AUTOSEC.DEVAUTOSEC.DEV
USD1 Faces a Coordinated Short-Selling Attack
  • Exploit Date: February 23, 2026
  • Target Project: WLFI Ecosystem and USD1 Stablecoin
  • Project Overview: USD1 is a stablecoin within the WLFI ecosystem, backed 1:1 by full reserves with robust minting and redemption mechanisms.
  • Loss Amount: No direct loss of contract funds (resulted in short-term price volatility and reputational impact).
  • Attack Vector: Combined Attack (Social Engineering + Market Manipulation)

Incident Review & Technical Details​

  1. Attack Path:
    • (1) The attackers first targeted the WLFI core team, successfully compromising the social media accounts of multiple co-founders. This was likely achieved through SIM Swapping, phishing emails, or Session Token theft.
    • (2) After gaining control of official communication channels, the attackers used the founders' accounts to post fraudulent statements regarding "protocol exploits" or "de-pegging." Simultaneously, they leveraged pre-coordinated KOLs (Key Opinion Leaders) to spread FUD (Fear, Uncertainty, and Doubt).
    • (3) Prior to releasing the fake news, the attackers had already opened massive short positions on $WLFI across DeFi lending platforms and Centralized Exchanges (CEXs). As panic selling ensued among retail investors, the attackers closed their shorts for profit.
  2. Impact: The incident only caused short-term market noise; it did not have a material impact on the stablecoin's peg or underlying fund security.
  3. Official Assessment: The USD1 stablecoin maintained its 1:1 peg, and its mechanisms remained fully operational.
  4. Investigation Progress: The project team has advised users to seek information only through verified official channels and is continuing efforts to maintain community stability.

AUTOSEC.DEV Solution: Building a 360-Degree Defense​

To counter these "Web2 Breach + Web3 Monetization" hybrid attacks, AUTOSEC.DEV provides comprehensive protection from code to personnel:

  1. Team OPSEC (Operations Security) Audit & Hardening: We provide enterprise-grade security training and configuration for core Web3 team members. We assist in deploying security hardware and risk detection software to increase the cost of social engineering attacks, while auditing password management protocols and device security policies.
  2. End-to-End Incident Response (IR): In an emergency, every second of confusion amplifies the loss. AUTOSEC.DEV provides standardized SOPs (Standard Operating Procedures) and rapid response services tailored to specific business needs to help projects mitigate losses quickly.

Service Content​

Reference​

https://x.com/worldlibertyfi/status/2025951491287089384