World Liberty Financial Senior Smart Contract Engineer Peter Girnus Admits to Designing Blacklist Function
Peter Girnus, Senior Smart Contract Engineer for World Liberty Financial (WLFI), publicly admitted on his personal platform that he designed and deployed a blacklist function that allows a single anonymous wallet to freeze the assets of any WLFI holder. This function was implanted in the v2 version through an upgradeable proxy contract just one week before the mainnet transactions opened. He stated that the contract was initially deployed in September 2024 as a standard ERC-20, auditable, and "appeared decentralized," but the team retained upgrade rights. On August 24, 2025, he added an external address with dual roles as both a "guardian" and a "multi-signatory" to a permissions system controlled by "3/5 multi-signature," allowing one person to trigger the freezing of any wallet.
Girnus claimed that the project set up a "Category 3" designation specifically for Justin Sun, with his $75 million investment locked independently, while a "batch reallocation" function was added in November 2025 as an administrative tool to "transfer tokens from any wallet to any other wallet at any time." The project described this as a "phishing attack relief mechanism," but it effectively constituted a "single point control fund dispatch." As of December 2025, the Trump family had withdrawn approximately $1 billion in cash profits through WLFI and held about $3 billion in unsold tokens, while ordinary investors, under the guise of "decentralized governance," were actually fully controlled by an anonymous wallet through the blacklist mechanism, whose identity remains undisclosed.
Source: Public Information
ABAB AI Insight
WLFI的“黑名单”与“批量再分配”结构，暴露了“去中心化叙事”与“中心化控制”在技术上的完美耦合。智能合约从“展示给投资者的透明代码”到“隐藏后门的升级版本”，本质上是通过“可升级代理”将信任从“代码‑审计”转移到“治理‑多签”。投资者面对的是“ERC‑20般干净的合约”，而项目方在后台保留了对冻结与资金再分配的永久控制权，这种“去中心化面纱，集中控制内核”的结构，已不再只是“技术风险”，而是制度欺骗。
从结构上看，WLFI设计了一套“分层控制权”：一类是普通投资者的“名义治理权”，另一类是总统家族与核心投资方的“实质控制权”。通过“类别3‑专属多签‑匿名地址‑批量转移”组合，项目在账本上保持“去中心化”的表象，但在资金流动与风险分配上实现了“超级集中”。这种结构特别危险的地方在于，它把“合规性”从“反洗钱与监管合规”扭曲为“公司对用户资产的强制干预合规”，使“合规”成为中心化的授权，而不是去中心化性的约束。
长期来看，WLFI事件可能成为加密行业“中心化‑后门化”项目的一个典型警示样本。在资本与知名度光环下，项目可以利用“可升级合约”与“复杂多签”创造一套“单点控制”机关，再用“合规‑安全‑救济”等话术将其合理化。这种结构一旦被大量复制，DeFi生态与“去中心化金融”的核心逻辑将被从内部掏空——合约代码依然是“开源的”，但权力中心却在“不可见的多签地址与监管借口”中。Girnus揭露的，不只是“一个后门”，而是一套“如何用合规理由包装中心控制权”的标准操作手册，未来任何“去中心化项目”都需要在“升级机制、多签与控制权”层面被重新审视，而不是在“代码是否开源”这种表层做尽职调查。