Attackers impersonated Lombard Finance members to trick Ionic Money into listing counterfeit LBTC. Attackers then minted 250 fake LBTC as collateral to borrow $8.6-8.8M in legitimate tokens, bridging ~$3.5M to Ethereum. Inadequate identity verification enabled the social engineering.