LianGo Protocol Incident Analysis

On 7 February 2023 CertiK reported that the LianGo (LGT) liquidity pool was drained after the pool owner’s private key was likely compromised; the attacker replaced the LP token with a malicious contract, minted and deposited fake LP tokens, called withdraw to empty the pool, and swapped roughly 6,148,859.35 LGT (~$1.63M) to BSC-USD, with funds traced to address 0xCb65d…. The report details the preparation and attack stages, transaction evidence, and concludes the incident was enabled by centralized control of the pool owner account.