H.E. Justin Sun 👨‍🚀 🌞 (@justinsuntron): Independent researchers have published a technical analysis of the USD1 smart contract.

Independent researchers have published a technical analysis of the USD1 smart contract. #USD1 $USD1 @worldlibertyfi #WLFI Everyone holding or considering USD1 should read it carefully. To put it in the bluntest terms, per their findings: USD1's highest-level permissions allow the issuer to move USD1 out of YOUR account into its own wallet — or anyone else's — without your consent. Cold wallet? Multisig? Doesn't matter. The authority operates at the token contract level. Nothing you do can stop it. Let that sink in: this is a "stablecoin" whose issuer holds the technical power to reach into any holder's wallet and take the funds. And there's a second finding that, frankly, is even more disturbing. Per the researchers' analysis, the USD1 source code published on World Liberty's official GitHub does NOT match the code actually deployed on-chain. The published version contains no "drain" or "reallocate" functions. The deployed version — after an April 2026 upgrade — contains both. Anyone in crypto knows exactly what that pattern is. Showing auditors and users a clean codebase while running different code on-chain is the signature technique of rug pulls. It sits at the top of every blockchain security firm's fraud-detection checklist — because there is no innocent reason to publish one contract and deploy another. Its only function is to defeat scrutiny. A company that is currently seeking a U.S. national trust bank charter is using a playbook straight out of the exit-scam manual. And as I allege in my Complaint, this is not the first time. The same pattern — backdoor functions added after the fact, contrary to public representations — is exactly what happened with the $WLFI token itself. First $WLFI. Now USD1. Once is a design choice. Twice is a pattern. Don't take my word for it. Don't take theirs. The contracts are on-chain — verify every claim yourself. That's what blockchains are for.