Levyathan Finance Leaked Owner Key

On July 31, 2021, the Fantom yield farm Levyathan Finance lost approximately $1.5 million after the team's owner/deployer private key was leaked — reportedly exposed via a public code repository. An attacker used it to mint unlimited LEV and drain the farm.

What happened

Levyathan's owner key was inadvertently exposed (committed to a public repo, per the team's own account). An attacker found it, assumed owner privileges, minted LEV without limit, and drained the pools (~$1.5M).

Why it matters

Levyathan is the leaked-key-via-public-repo variant of single-key compromise (RocketSwap is its server-side cousin). It's the most preventable possible instance: no malware, no phishing, no sophisticated adversary — a secret committed to public source control and scraped. The catalogue's operational-security thesis in its starkest form: most catastrophic key compromises are not sophisticated; they are hygiene failures — keys in repos, keys on dev laptops, keys decryptable beside their ciphertext. The defense is not advanced cryptography; it is not putting the key where the world can read it.