Trump-Linked USD1 Stablecoin Depegs to $0.98 Amid Coordinated WLFI Attack

On February 23, 2026, USD1, the flagshipstablecoin issued by World Liberty Financial (WLFI), briefly lost its $1 peg in what the project’s team described as a “coordinated attack.” The token, which is backed by entities linked to President Donald Trump’s family and currently ranks as the fifth-largest stablecoin by market capitalization at approximately $4.8 billion, slipped as low as $0.98 on Binance before recovering to near-parity within roughly 30 minutes.

The incident combined social engineering, market manipulation, and paid influencer campaigns in what appears to be one of the most sophisticated stablecoin attacks of 2026. While USD1 ultimately held its peg, the event raises important questions about stablecoin resilience, the role of political connections in crypto projects, and how investors should think about stablecoin risk.

What Happened: A Timeline of the Attack

The attack unfolded across multiple fronts simultaneously on the morning of February 23, 2026.

Phase 1: Account Compromise. Hackers gained access to X (formerly Twitter) accounts belonging to several WLFI cofounders. Using these compromised accounts, they posted falsified information designed to create fear, uncertainty, and doubt around the USD1 stablecoin and the broader WLFI ecosystem. The posts suggested problems with USD1’s backing and hinted at internal instability.

Phase 2: Paid FUD Campaign. According to WLFI, the attackers paid crypto influencers to amplify the misleading information from the hacked accounts. This created the appearance of a broader crisis rather than an isolated hack, with negative messaging spreading rapidly across crypto social media channels.

Phase 3: Market Manipulation. While the fear campaign escalated, the attackers opened large short positions against the WLFI governance token. The goal was to profit from the panic selling triggered by the manufactured crisis. As WLFI’s price dropped (falling nearly 8% at its worst), the shorts generated returns for the attackers.

Phase 4: USD1 Price Impact. The combined effect of hacked accounts, influencer-driven FUD, and WLFI token shorts spilled over into USD1’s market. The stablecoin dropped from $1.00 to approximately $0.98 on Binance, according to screenshots shared by Wu Blockchain. CoinGecko recorded a smaller dip, showing USD1 falling to $0.994. The Block’s data showed an even milder drop to $0.997.

Phase 5: Recovery. USD1 recovered to near-parity within approximately 30 minutes. WLFI attributed the rapid stabilization to the stablecoin’s mint-and-redeem mechanism, which allows arbitrage traders to buy discounted USD1 and redeem it for $1 worth of underlying assets, naturally pushing the price back to its peg.

Why USD1 Recovered (and Why That Matters)

The speed of USD1’s recovery highlights a critical principle in stablecoin design: redemption mechanisms matter more than marketing promises.

USD1 is issued in partnership with crypto custodian BitGo and is backed 1:1 by short-term US government Treasuries, US dollar deposits, and other cash equivalents. Monthly attestations of reserves are provided by consulting firm Crowe. When USD1 trades below $1, arbitrageurs can buy the discounted tokens and redeem them for the full $1 worth of underlying assets, pocketing the difference. This creates natural buying pressure that pushes the price back to peg.

This is fundamentally different from how algorithmic stablecoins like TerraUSD (UST) worked before their catastrophic collapse in 2022. TerraUSD relied on arbitrage between two tokens (UST and LUNA) rather than direct asset backing. When confidence evaporated, there was no hard floor to catch the fall.

WLFI cofounder Zach Witkoff addressed the situation directly, stating that USD1 is “100% backed and 100% verifiable” and was designed to be “GENIUS Act compliant, fully backed, and radically transparent.” The GENIUS Act, passed earlier in 2025, established the first comprehensive federal framework for stablecoin regulation in the United States.

The Bigger Picture: Political Controversy and ZachXBT Investigation

The USD1 depeg did not happen in a vacuum. Several factors made this incident more significant than a typical stablecoin wobble.

The Political Dimension. WLFI’s close ties to the Trump family have made it a lightning rod for controversy. Earlier this year, a UAE-based entity used USD1 to facilitate a $2 billion investment in Binance, raising questions about potential conflicts of interest given the president’s involvement with the project. WLTC Holdings LLC has also filed an application to establish a national trust bank to expand USD1’s operations.

Deleted Tweets. Unverified reports circulated on social media claiming that Eric Trump deleted older promotional posts related to WLFI during the volatility. Screenshots were shared online, but no independent confirmation has verified these claims as of this writing.

ZachXBT Investigation. Adding fuel to the fire, blockchain investigator ZachXBT announced plans to release findings on February 26 regarding alleged insider trading involving a major crypto company. He did not name the firm, but social media users immediately speculated about potential connections to WLFI. There is no evidence supporting this claim at the time of writing, and any connection remains purely speculative.

Market Context. The attack came days after the inaugural WLFI Forum and during a period of extreme market stress.Bitcoin has fallen below $65,000 amid broader market sell-offs, making the entire crypto ecosystem more vulnerable to fear-driven events.

Lessons for Stablecoin Investors

This incident offers several important takeaways for anyone holding or trading stablecoins.

Redemption mechanisms are the foundation of stablecoin safety. USD1’s ability to recover quickly was directly tied to its 1:1 backing and direct redemption feature. When evaluating stablecoins, the ability to convert tokens back to dollars (or dollar-equivalent assets) at any time is the single most important feature to look for.

Social engineering attacks are becoming more sophisticated. The combination of account hacking, paid influencer campaigns, and coordinated short selling represents a new level of attack complexity. Traders should always verify information through official channels before making decisions based on social media posts, especially during periods of high volatility.

Even well-backed stablecoins can temporarily lose their peg. A 0.3-2% deviation from peg, while small, can create cascading effects in leveraged positions and DeFi protocols that depend on precise pricing. Understanding this risk is essential for anyone using stablecoins as collateral.

Diversification across stablecoins remains prudent. No single stablecoin is immune to attack or temporary disruption. Holding positions across USDT, USDC, and other major stablecoins reduces exposure to any single issuer’s operational risk.

What Comes Next

The coming days will be critical for USD1 and WLFI. ZachXBT’s scheduled February 26 report could either implicate WLFI in insider trading allegations or clear the air entirely. WLFI has not disclosed technical details of how the cofounder accounts were compromised, and the broader market will be watching for transparency on this front.

For now, USD1 has recovered and is trading at parity. The stablecoin’s structural design, specifically its 1:1 asset backing and direct redemption feature, prevented what could have been a much worse outcome. But the incident serves as a reminder that in crypto, even the largest and best-connected projects are not immune to sophisticated attacks.

For traders looking to navigate stablecoin markets safely,MEXC provides access to multiple stablecoin trading pairs with deep liquidity and transparent order books.

Disclaimer: This content is for educational and reference purposes only and does not constitute any investment advice. Digital asset investments carry high risk. Please evaluate carefully and assume full responsibility for your own decisions.