TLDR
- WLFI recovered $22M in tokens after phishing attacks and the exposure of seed phrases compromised several user wallets.
- The project executed an emergency burn-and-reallocate function to replace stolen tokens and protect affected users.
- WLFI froze compromised wallets in September and required users to complete KYC registration before initiating the recovery process.
- New smart contract logic was tested to ensure controlled transfers and the secure reallocation of tokens to verified addresses.
- WLFI reminded users to use only official channels for token recovery and warned about scams and fake support accounts.
World Liberty Financial (WLFI) has carried out an emergency burn-and-reallocate action to recover millions of WLFI tokens that were compromised before the project’s official launch. The action, announced on November 19, 2025, involved burning approximately 166.667 million WLFI tokens, valued at roughly $22.14 million. These tokens were previously stolen from user wallets through phishing attacks and had their seed phrases exposed before the launch.
Compromised Wallets Trigger Emergency Recovery Action
Several wallets were compromised due to security lapses from third-party services, not WLFI’s own contracts. Phishing schemes targeted users, while others fell victim to the exposure of their wallet seed phrases. In response, WLFI froze affected wallets in September, urging users to verify their identities and complete know-your-customer (KYC) registration.
To further safeguard the process, WLFI began collecting new, secure wallet addresses from affected users. They implemented an emergency function on November 19, 2025, designed to burn compromised tokens and issue replacements to verified recovery addresses. WLFI stated,
“We designed this emergency function to protect users from losing tokens to attackers and to ensure that only verified addresses receive the tokens.”
Controlled Transfers and Token Burn Process
The emergency function worked by burning 166.667 million WLFI tokens from compromised wallets and reallocating them to verified addresses. WLFI explained that the move was part of a new smart contract logic designed to facilitate controlled transfers. Emmett Gallic, an on-chain analyst, commented,
“The function was created for situations where tokens fall into the hands of attackers or when users lose wallet access before token vesting.”
WLFI ensured a slow, careful approach to avoid errors in the token recovery process. The project emphasized that only users who completed the necessary checks would receive their tokens in newly secured wallets. Users who had not completed the verification process would continue to have their wallets frozen until they reach out for assistance through WLFI’s help center.
Impact of Phishing and Leaked Keys
Most of the affected wallets were targeted by phishing attacks, resulting in compromised keys and drained wallets. Some of these incidents were linked to issues during Ethereum’s Pectra upgrade in September. During the upgrade, attackers deployed malicious contracts into compromised wallets, which eventually triggered token drains.
At that time, WLFI froze 272 wallets and warned users not to rely on fake support accounts or scam clones. WLFI stated that while the number of affected wallets was limited, it urged all users to complete verification to ensure proper token recovery. The team also reminded users to only use official WLFI channels for recovery assistance.
WLFI Continues Development Amid Legal Scrutiny
As WLFI continues its recovery efforts, the project faces scrutiny from lawmakers. Senators Elizabeth Warren and Jack Reed have requested that federal agencies to investigate claims that WLFI tokens were sold to sanctioned entities. WLFI has not commented on the allegations in its recent statements.
Despite the ongoing investigations, WLFI is focused on its future development. The project is working on its upcoming USD1 stablecoin and other integrations. Once the token recovery process is completed, the WLFI team plans to continue advancing their platform and offering new services to users.


