A machine with access to Surf Lending’s admin key was compromised. According to Surf’s lead developer, the incident was not caused by a smart-contract bug. Surf placed the protocol into maintenance mode, temporarily migrated user vaults and supplied assets to its multisig treasury wallet, and began migrating the V1 contracts while rebuilding the affected infrastructure in a more secure environment. Surf subsequently described the event as a security incident and prioritized restoring V1