Stablecoin Payment Firm Infini Loses $50M in Exploit, Promises Full Compensation

The perpetrator is believed to have worked on the Infini project for contract development but secretly kept admin rights after the project was completed

Stablecoin payment firm Infini has lost nearly $50 million in an exploit that was conducted by a developer who retained administrative privileges after project delivery, according to security firm Cyvers.

The attacker funded the wallet used in the hack with 1 Ether (ETH) from the cryptocurrency mixing service Tornado Cash and went on to transfer $49.52 million in USD Coin (USDC) from Infini through a contract they created in November 2024.

The USDC was immediately swapped for Dai (DAI), a stablecoin that doesn’t have a freeze function. The funds were then converted to 17,696 ETH and moved into a secondary address at the time of writing.

The Infini team did not pause withdrawals, and founder Christian Li claimed in an X post that full compensation would be paid in a worst-case scenario.

The platform has observed $500,000 in withdrawals since the theft, according to Li.

In a now-deleted tweet, Infini team member “Christine” stated that the engineer responsible for the theft had been identified and reported to the police.

However, when asked by Cointelegraph to confirm the information, she said: “We are still investigating.”

The attack on Infini follows a record-breaking hack on cryptocurrency exchange Bybit, which lost $1.4 billion in Ether and related tokens on Feb. 21.

The large-scale attack on a major exchange raised concerns about possible insolvency at the time. However, the exchange opted for a rare strategy of keeping withdrawals open and vowed to cover the loss if funds could not be recovered.

Bybit relied on loans from partners and rival exchanges to meet the immediate liquidity demands of customer withdrawals, which totaled over $5 billion, according to DefiLlama data.

On Feb. 24, Bybit CEO Ben Zhou announced that the exchange had fully closed its Ether gap.

Onchain detective ZachXBT identified North Korea’s state-sponsored hacking group Lazarus as a prime suspect in the attack on Bybit.

ZachXBT linked the Bybit hacker’s wallet to an attack carried out on Phemex in January, as well as to the attack against BingX, both of which have been attributed to North Korea.