Ionic Protocol Hack
What happened
On February 4, 2025, attackers used a social-engineering campaign to have a counterfeit Lombard Bitcoin Token, or LBTC, accepted as collateral by Ionic Money's Mode main market. They minted the fake token, deposited it as collateral, and borrowed real supplied assets from the protocol.
This was not a smart-contract code exploit. Ionic's asset-onboarding process accepted a counterfeit token as valid collateral based on attacker-controlled identity and integration signals. The protocol then treated the unbacked token as borrowable collateral.
How it happened
After weeks of impersonating Lombard Finance in business-development discussions, the attackers obtained approval for a fake LBTC token. The listing was supported by a Balancer pool and an API3 price feed, which made the asset appear legitimate. Once it was accepted with a 250-LBTC supply cap, the attackers minted all 250 tokens, deposited them into Ionic, borrowed legitimate assets, and moved part of the proceeds through cross-chain routes.
Ionic's post-mortem reports $12.3 million of supplied assets stolen. Assets frozen at the Mode network level are not counted as recovered funds, because no completed restitution has been reported.
Protocol details
Security review history
- Zellic View report
Evidence
- report @CyversAlerts incident report x.com
- report @ionicmoney incident report x.com
- report @CertiKAlert incident report x.com
- report Ionic Mode Main Market Exploit Post-Mortem postmortem.s3.us-east-1.amazonaws.com
- report Ionic Money Incident Analysis rekt.news
- transaction Mode Borrow Transaction explorer.mode.network
- analysis DeFiLlama defillama.com
- analysis Explained: The Ionic Money Hack halborn.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
