- Infini lost $49.5M in USDC after an attacker exploited retained admin privileges.
- The stolen funds were converted to 17,696 ETH and transferred to a new wallet.
Crypto-focused neobank Infini has suffered a $49.5 million exploit, with the attacker swapping stolen funds for Ethereum before moving them to a separate wallet. The breach follows a string of major crypto security incidents, including Bybit’s $1.4 billion hack.
How the Attack Unfolded
CertiK first detected the suspicious activity on Feb. 24 at 3:18 am UTC. The attacker used a retained administrative privilege to gain unauthorized access to an Infini-related Ethereum contract. They withdrew 49.5 million USDC before exchanging it for DAI. The DAI was then used to buy 17,696 ETH. Lookonchain later identified that the Ethereum was moved to a new wallet.
It seems that the stablecoin bank @0xinfini was hacked and 49.5M $USDC was stolen.
— Lookonchain (@lookonchain) February 24, 2025
The hacker swapped 49.5M $USDC for 49.5M $DAI and bought 17,696 $ETH.
The 17,696 $ETH was transferred to a new wallet "0xfcc8…6e49".https://t.co/AdAyB3q5LA pic.twitter.com/Rft6ZDtDWO
According to blockchain security firm Cyvers, the attacker was a former developer who never relinquished full control over the contract. More than 100 days before the exploit, they funded their wallet through Tornado Cash, covering gas fees in preparation for the breach.
Infini co-founder Christian Li acknowledged the breach, taking responsibility for the mismanagement of administrative privileges. He assured customers that the platform remains financially stable and will fully compensate affected users.
“My personal private key was not leaked. This happened due to negligence when transferring authority. It’s my responsibility,” Christian stated.
Circle’s Response
Blockchain investigator ZachXBT criticized stablecoin issuer Circle for its delayed response. He noted that the stolen USDC was not fully converted for 40 minutes, questioning Circle’s incident response capabilities.
This is not the first time he has criticized Circle for its handling of malicious transactions involving USDC. He argued that U.S. companies often hide behind regulatory ambiguity rather than taking proactive security measures.
This breach follows Bybit’s $1.4 billion hack, which was linked to North Korea’s Lazarus Group. Bybit has since restored its reserves, securing over $1.2 billion in Ethereum to maintain platform stability.
Highlighted Crypto News Today
Global Crypto Funds Witness $508M Weekly Outflows, Says CoinShares
