Infini loses $50M in exploit, developer fraud suspected

165

Infini, a stablecoin payment firm, has lost $50 million in an exploit allegedly orchestrated by a developer who retained administrative privileges post-project completion. The attacker, who worked on the contract development, executed the hack by funding their wallet with 1 Ether from Tornado Cash. The stolen $49.52 million in USD Coin (USDC) was swapped for Dai (DAI) and later converted into Ethereum (ETH). At present, Infini has not paused withdrawals, with founder Christian Li assuring full compensation if needed. This exploit follows the record-breaking $1.4 billion hack of Bybit.

1. Understanding Infini: Business Model, Founders, and Services

1.1 Business Model: Infini operates as a stablecoin payment platform, facilitating seamless transactions using blockchain technology. The firm aims to provide secure and efficient payment solutions for businesses and individuals leveraging digital assets.

1.2 Revenue Model: Infini generates revenue through transaction fees, liquidity provisions, and enterprise partnerships. Its ecosystem is built on smart contracts that ensure automated and secure transactions.

1.3 Founders and Background: Infini was co-founded by Christian Li, an experienced blockchain entrepreneur, and a team of fintech experts. With a focus on decentralized finance (DeFi), the company has positioned itself as a key player in the stablecoin payment sector.

1.4 Services and Offerings:

• Cross-border stablecoin transactions
• Smart contract-based financial solutions
• Integration with leading blockchain networks
• Compliance-focused payment solutions

2. The Exploit: How Infini Lost $50M

2.1 Method of Attack: The attack was executed by a developer who had previously worked on the project. Security firm Cyvers reported that the individual retained unauthorized admin privileges, allowing them to manipulate the system.

2.2 Hacker’s Strategy:

• Used 1 ETH from Tornado Cash for wallet funding.
• Deployed a custom contract created in November 2024.
• Drained $49.52 million in USDC from Infini.
• Converted USDC into DAI, avoiding transaction freezes.
• Transferred assets into 17,696 ETH and moved funds to another wallet.

3. Security Implications and Industry Reactions

3.1 Infini’s Response: Christian Li assured users that compensation would be provided if necessary. Despite the attack, Infini has not halted withdrawals, recording $500,000 in transactions post-incident.

3.2 Security Experts’ Views: Industry analysts highlight the risks associated with retaining admin privileges. The case underscores the importance of rigorous security audits and multi-signature control mechanisms.

3.3 Impact on the Crypto Market: This attack raises concerns about vulnerabilities in DeFi projects. Investors and users are now more cautious about security risks associated with smart contracts.

4. Previous Crypto Hacks and Lessons Learned

4.1 Bybit’s $1.4 Billion Hack: The Infini exploit follows the largest cryptocurrency hack in history. Bybit lost $1.4 billion due to an attack on February 21, 2025.

4.2 Comparative Analysis: While Bybit opted for liquidity loans to maintain stability, Infini is taking a different approach by ensuring user confidence through compensation guarantees.

5. Learning for Startups and Entrepreneurs

5.1 Ensuring Smart Contract Security: Startups must implement rigorous security audits and restrict admin privileges post-project completion.

5.2 Monitoring Fund Movements: Continuous tracking of blockchain transactions can help detect anomalies early.

5.3 User Transparency and Crisis Management: Clear communication with users in the event of security breaches helps maintain trust and credibility.

About The Startups News

When it comes to providing the latest startup insights, The Startups News is a leading platform covering technology disruptions, venture capital trends, and innovation updates. Whether it’s blockchain security or fintech growth strategies, we deliver high-quality startup news for Indian entrepreneurs and beyond.