Seedify SFUND Bridge Hacked, $1.2M Stolen

In Brief

Significant Security Breach at Seedify: On September 23, Seedify, a recognized web3 launchpad, experienced a severe security breach. Unauthorized individuals accessed a developer’s private key and exploited the cross-chain bridge to mint and sell SFUND tokens illicitly.

Suspected North Korean Involvement: Analysis points to a state-connected North Korean hacker group as the culprits behind this sophisticated attack.

Planned Recovery Initiatives: Seedify announced a “Phoenix Raise” plan aimed at compensating affected users, enhancing security measures, and moving towards a more secure, permissionless system.

Unauthorized Access and Token Minting

On September 23, Seedify fell victim to a major security exploit where a developer’s private key was hijacked. This key was used to manipulate the system’s OFT bridge contract—a component previously cleared by numerous security audits. The breach enabled the attackers to mint vast quantities of SFUND tokens on the Avalanche chain, sidestepping the usual requirement of equivalent deposits, resulting in significant discrepancies in token balances.

Today at approximately 12:05 UTC, a DPRK state-affiliated group known for many hacks in Web3 gained access to one of our developer’s private keys. Using these, they were able to mint a large amount of SFUND tokens through a bridge contract that had previously passed audit.

The…

— Seedify (@SeedifyFund) September 23, 2025

Broad Impact Across Chains

Following the minting, the attackers executed rapid transactions across multiple blockchains including Ethereum, Arbitrum, and Base, thus draining liquidity pools. A large portion of the illicitly obtained tokens was subsequently transferred to the BNB Chain and sold off, triggering an almost 60% plummet in the token’s market price. More than $1.2 million worth of value was siphoned from the system during this coordinated attack.

Immediate Measures and User Warnings

Seedify responded promptly to the breach by shutting down the compromised bridge and suspending token transactions on the impacted platforms to prevent further damage. Trading was also temporarily halted on centralized exchanges to manage market volatility effectively. Efforts to mitigate losses included freezing about $200,000 of the stolen funds.

Attack Attribution

The attack was attributed to a notorious North Korean hacker group, well-known within the web3 community for its previous cyber offenses. This attribution was supported by onchain analysis from security professionals such as ZachXBT and ZeroShadow, who documented the precision and rapid progression of the token movements across four different blockchains.

Introducing the “Phoenix Raise”

Meta Alchemist, the founder of Seedify, announced a remediation and improvement strategy dubbed the “Phoenix Raise”. This initiative is designed to address the breach’s repercussions through user compensations, token buybacks, and a major overhaul of security protocols. It encompasses comprehensive contract re-audits and a new bounty program aimed at exposing security vulnerabilities.

Ongoing Challenges and Resolutions in Web3 Security

The incident has highlighted ongoing vulnerabilities in cross-chain bridge operations and centralization risks, prompting a wider discussion on enhancing security measures. Proposals include adopting multi-signature processes and introducing execution delays for critical functions to strengthen the infrastructure against future attacks.

Conclusion

The breach at Seedify acts as a stark reminder of the complexities and risks associated with web3 technologies, particularly regarding the handling of private keys and security protocols. The platform’s response and the execution of the “Phoenix Raise” initiative could potentially set a new standard in the industry for crisis management and recovery from cyber-attacks in the cryptocurrency domain.