Aug 2025 - Level USD Twitter/X Takeover Content Violation Phishing - $Unknown (Global)
Level USD (lvlUSD) is a stablecoin backed by USDC and USDT, generating yield from reputable blue-chip lending protocols. With a market capitalization of $2.91M and over 17,000 users, lvlUSD offers users the opportunity to earn yield by staking it in lending protocols. The product aims to provide superior risk-adjusted yield while enhancing utility and capital efficiency in decentralized finance (DeFi). However, the team has announced that they are joining a leading DeFi protocol and will be sunsetting the product, signaling the end of its active development.
Staked lvlUSD, or slvlUSD, acts as a yield-bearing token that exclusively earns yield from lending protocols. The slvlUSD market cap stands at $1.63M, offering an annual percentage yield (APY) of 9.55%. This system allows users to earn passive returns through staking, contributing to the overall appeal of lvlUSD within the DeFi space. The integrations with well-known DeFi platforms like Pendle, Morpho, Curve, Spectra, and LayerZero expand the usability of lvlUSD across multiple decentralized applications and ecosystems.
The platform has forged partnerships with major players in the crypto industry, including Polychain Capital, Dragonfly Capital, and Aave, and focuses on maintaining transparency and community engagement. Users can access more information via the platform’s documentation and official announcements. Although the product is not available for U.S. persons, the integrations with various DeFi protocols and its focus on efficient capital usage make lvlUSD a promising tool for DeFi participants.
Unfortunately, the Twitter/X account appears to be compromised.
According to the description provided on the team Discord: "A phishing email impersonating X Support claimed our account had a “content violation” and would be closed in 48h unless appealed. The email perfectly mimicked official styling and URLs. When the link was clicked, the attacker reset credentials, removed delegates, and began sharing malicious links, including a fake site designed to trick wallets."
It is unknown who was affected by the incident.
The breach was detected immediately, prompting the team to issue warnings on Discord and Telegram within 15 minutes. The team reported they simultaneously began reporting malicious links, contacting security partners, and escalating the issue with X to mitigate the impact.
Full control of the account was restored after 18 hours. Moving forward, the team is implementing stricter access controls with multi-layer authentication, enhanced monitoring and incident response procedures, and closer coordination with X to improve escalation and recovery times.
Users who were impacted were instructed to "please visit [the Level Money] Discord and open a ticket so [their] team can assist you."
Level Money is providing ongoing support for anyone potentially impacted and encourages affected users to open a ticket on Discord. There is currently no indication of who was behind the compromise. Level more recently announced their acquisition by a large DeFi firm and the planned shutdown (sunsetting) of their product.
Further Analysis
Level Money, a decentralized finance (DeFi) platform offering yield-bearing stablecoins like lvlUSD, faced a security breach when a phishing email, impersonating X Support, tricked the team into clicking a malicious link that compromised their account. This allowed attackers to reset credentials, remove delegates, and distribute harmful links, including a fake site designed to steal wallet information. The breach was detected swiftly, and within 15 minutes, the team issued warnings on Discord and Telegram, while also reporting the attack and coordinating with security partners. Full control of the account was regained after 18 hours, and the team implemented stronger security measures, including multi-layer authentication and enhanced incident response procedures, to safeguard against future attacks. Any affected users are instructed to reach out to the team and open a ticket via Discord.
How Could This Have Been Prevented?
More Cryptocurrency Exchange Hacks/Scams/Frauds
DX3 AI Bot Exchange Function Price Manipulation Vulnerability > > < < BTCTurk Significant Multiple Chain Hot Wallet Withdrawals
Sources/Further Reading
Level USD - "We've officially regained access to the @LevelUSD account on X. We sincerely apologize to everyone for the risk and disruption caused by this incident. Our team has been working non-stop to resolve the situation and protect the community. If you believe you were impacted by the recent attack, please visit our Discord and open a ticket so our team can assist you. A full post-mortem detailing what happened and every step we took will be shared in the coming days." - Twitter/X (Dec 31)
Level USD Twitter/X Account (Dec 31)
Level Money Documentation (Dec 31)
levelusd - Description Of Level Money - Twitter/X (Dec 31)
 t.me/QuadrigaInitiative
|
 /r/QuadrigaInitiative
|
 @QuadrigaInit
|
 info@quadrigainitiative.com
|