Infini Neobank Suffers $49.5M Hack Due to Insider Exploit

• Infini lost $49.5M in USDC after an attacker exploited retained admin privileges.
• The stolen funds were converted to 17,696 ETH and transferred to a new wallet.

Crypto-focused neobank Infini has suffered a $49.5 million exploit, with the attacker swapping stolen funds for Ethereum before moving them to a separate wallet. The breach follows a string of major crypto security incidents, including Bybit’s $1.4 billion hack.

How the Attack Unfolded

CertiK first detected the suspicious activity on Feb. 24 at 3:18 am UTC. The attacker used a retained administrative privilege to gain unauthorized access to an Infini-related Ethereum contract. They withdrew 49.5 million USDC before exchanging it for DAI. The DAI was then used to buy 17,696 ETH. Lookonchain later identified that the Ethereum was moved to a new wallet.

According to blockchain security firm Cyvers, the attacker was a former developer who never relinquished full control over the contract. More than 100 days before the exploit, they funded their wallet through Tornado Cash, covering gas fees in preparation for the breach.

Infini co-founder Christian Li acknowledged the breach, taking responsibility for the mismanagement of administrative privileges. He assured customers that the platform remains financially stable and will fully compensate affected users.

“My personal private key was not leaked. This happened due to negligence when transferring authority. It’s my responsibility,” Christian stated.

Circle’s Response

Blockchain investigator ZachXBT criticized stablecoin issuer Circle for its delayed response. He noted that the stolen USDC was not fully converted for 40 minutes, questioning Circle’s incident response capabilities.

This is not the first time he has criticized Circle for its handling of malicious transactions involving USDC. He argued that U.S. companies often hide behind regulatory ambiguity rather than taking proactive security measures.

This breach follows Bybit’s $1.4 billion hack, which was linked to North Korea’s Lazarus Group. Bybit has since restored its reserves, securing over $1.2 billion in Ethereum to maintain platform stability.

Highlighted Crypto News Today
Global Crypto Funds Witness $508M Weekly Outflows, Says CoinShares