CZ confirms $1.2 million SFUND hack, and DPRK hackers say it's likely to be involved

Table of Contents

The Seedify ($SFUND) community shook this week after attackers drained more than $1.2 million through bridge exploits. The hack, spreading across several chains, is currently attracting attention from Binance’s co-founder Changpeng “CZ” Zhao. He confirmed the violation and suggested that hackers linked to North Korea’s DPRK could be behind the theft.

How Hack unfolded

On September 23rd, blockchain researcher Meta Alchemist reported that someone had violated the Seedify bridge and cross-chain contract. The attacker minted new $sfund tokens across multiple networks. Includes BNB chains, polygons, arbitrum and base. Hackers quickly exchanged these newly created tokens for assets such as BNB and ETH. This allows hackers to emit fluidity from the ecosystem.

According to the initial report, the attacker created billions of fake tokens on the base and exchanged them for 141 ETH. The BNB chain traded the $8.7 million SFUND for about $1.2 million worth of BNB. The team estimates the total theft of the chain to be around $1.7 million. Spector, an analyst on the chain, revealed that the attackers spread the stolen funds across several addresses. This tactic makes it difficult for investigators and exchanges to track the flow.

CZ responds and funds freeze

As the situation escalated, members of the Seedify community called for CZ to intervene. In a direct post to him, Meta Alchemist pointed out that over 64,000 BNB chain users were affected. Ask for immediate action before funds close the blockchain. CZ later responded with an X and said he consulted industry security experts. He confirmed that roughly $200,000 of the stolen assets have already been frozen in Exchange HTX. The rest said it would remain on the chain, but now it is likely to be flagged by a major central exchange. “It looks like North Korea’s DPRK,” CZ wrote, adding that the large exchange is likely blacklisting hacker addresses.

DPRK Link Surface

This is not the first time a linked group in North Korea has linked hacks to a bridge. The country’s Lazarus group is connected to several famous exploits. This includes the $620 million Ronin Bridge Hack for 2022. In this case, blockchain investigator ZachxBT pointed out the funding address associated with SFUND hacks that overlapped with past Serenity Shield wallets. Other exploits linked to DPRK related groups. Additional on-chain evidence shows that funds are flowing through addresses previously active in cases related to North Korea’s cybercriminal activities. This overlap reinforces doubt that the same network of state support hackers is responsible.

Market and Community Impact

The price of $sfund plunged almost 60% in the time after the violation. It went down about $0.05 before recovering slightly at nearly $0.17. For many holders, economic losses are serious. But the emotional sacrifice is just as heavy. Community members expressed their frustration and sadness throughout social media. One former member of the Seedify team said it was “gotten” for current developers and investors who trust the project.

Others have urged well-known investigators like Zachxbt to intervene and support. Despite the set-up, the BNB chain had already begun investigating the issue by making sure it was aware of the incident. Exchange to blacklist your hacker wallet. Attackers may have limited options for offloading funds. Still, most of the stolen money remains out of reach.

Continuing battle with Bridge Exploits

SFUND exploits are added to the long list of bridge-related hacks. It plagues the crypto industry. Cross-chain bridges continue to be one of the weakest points of decentralized finance. Hackers often target their complex designs and large liquidity pools. For Seedify, the challenge now is to restore trust between the community.

CZ and major exchanges intervene to freeze some of the funds. Several damage controls are possible. But the broader industry lessons are clear. The security gap in cross-chain infrastructure continues to attract some of the world’s most sophisticated hacking groups. As regulators, exchanges and developers work to address these vulnerabilities. Incidents like Sfund Hack highlight the amount of work we still have to do.