Facebook
Twitter
LinkedIn

Infini Crypto Bank Hit by $49.5 Million Hack Due to Insider Exploit

Infini Crypto Bank Hit by $49.5 Million Hack Due to Insider Exploit

Breaking News: Infini Crypto Neo-Bank Suffers $49.5 Million Hack

In a startling breach of security, Infini, a prominent crypto neo-bank, reported a massive loss of $49.5 million due to an exploit allegedly conducted by a former developer. The developer, who previously worked on Infiniโ€™s contract, allegedly abused administrative privileges to siphon funds from the platform.

Details of the Hack

Cyvers, a blockchain analytics platform, reported that the attacker exploited their retained administrative rights, which went undetected for over 100 days. The attacker drained the funds in two significant transactions from the Morpho MEVCapital USDC Vault, totaling $49.5 million.

The attackers swiftly converted the stolen funds from USD Coin (USDC) to Dai (DAI) and then into 17,696 ETH, which they transferred to a secondary address. This rapid movement of funds highlights the sophisticated nature of the attack.

Response from Infiniโ€™s Founder

Christian Li, the founder of Infini, addressed the breach on Twitter, acknowledging the oversight in transferring authority and taking full responsibility for the incident. Despite the setback, Li reassured users that Infiniโ€™s liquidity remained unaffected and that the company would offer full compensation if needed. He also extended an olive branch to the hacker, offering a 20% return bounty for the stolen funds and promising no legal action if the funds were returned.

Industry Experts Weigh In

Experts from QuillAudits, a smart contract audit firm, confirmed that the breach was due to compromised access and privilege escalation. Specifically, they noted that the hacker had access to a private key linked to a specially privileged account, which allowed the withdrawal of the funds.

Meanwhile, Hakan Unal, a Senior Blockchain Scientist at Cyvers, emphasized the critical risks associated with retained administrative privileges in smart contracts. Consequently, he advised that projects must thoroughly audit and revoke unnecessary permissions post-deployment to prevent such exploits.

Broader Implications for the Crypto Industry

This incident at Infini is not isolated. Just days before, the crypto exchange Bybit suffered a colossal loss of $1.4 billion in Ethereum and related tokens. On-chain analysis pointed to the Lazarus Group, a North Korean state-sponsored hacking group, as the culprits behind the attack.

The growing frequency of these incidents, with over $2.2 billion in crypto stolen last year alone, underscores the urgent need for enhanced security measures in the DeFi space. According to a report by Chainalysis, the number of individual hacking incidents rose from 282 in 2023 to 303 in 2024, with 50% of the stolen funds linked to North Korean groups.

As the crypto industry continues to evolve, platforms must prioritise robust security protocols to safeguard user assets effectively. Treating access control as a core security priority is crucial.

Infini has assured its users that the team is rigorously performing all system checks to secure the platform and prevent future breaches. The companyโ€™s proactive approach in handling the situation demonstrates its commitment to user security and may set a precedent for other platforms in the industry.

For more insights into the importance of security in the crypto industry, check out our article on securing talent in crypto.

Facebook
Twitter
LinkedIn
Looking for your next role?
Looking to hire?