Infini’s Bounty: A Hacker’s Delight or Just a Digital Comedy?

In a world where digital currencies dance on the precipice of chaos, Christian Li, the illustrious founder of the stablecoin digital bank Infini, found himself in a peculiar tête-à-tête with a hacker. With a flick of his digital quill, he inscribed yet another message upon the blockchain, reaffirming the white-hat agreement and a tantalizing 20% bounty on the stolen funds. Ah, the irony of it all!

With a mere transfer of 0.1 ETH, Li reached out to the thief who had audaciously pilfered a staggering $49.5 million from Infini’s vaults. In his message, he couldn’t help but commend the hacker’s remarkable talent for unearthing vulnerabilities in the neobank’s protocol. “Bravo!” he might as well have exclaimed, as he proposed a white-hat agreement, offering the hacker a generous 20% of the stolen assets. And, in a twist worthy of a farcical play, he assured the hacker that no legal repercussions would follow should they choose to return the funds. What a generous soul!

This was not the first correspondence from Infini to the hacker. On that fateful day, February 24, when the hack transpired, Infini had already issued a warning, declaring their vigilant watch over the hacker’s address. They were ready to spring into action, poised to freeze the stolen funds if the need arose. A 20% bounty was again dangled before the hacker, with a 48-hour ultimatum to respond. Fail to comply, and the long arm of the law would be unleashed. How thrilling!

Important update:

We’ve identified critical info regarding the exploit and we’re monitoring involved addresses.

— Infini (@0xinfini) February 24, 2025

The audacity of the hacker! Stealing $49.5 million from Infini’s wallets, just days after the bank triumphantly announced it had reached a total value locked of $50 million. A true masterstroke of timing!

CertiK, the vigilant watchdog of the crypto realm, first detected the suspicious activity on that fateful day, noting unauthorized transfers from an Infini-related contract on Ethereum. The hacker, with the finesse of a seasoned magician, gained access to the account “0xc49b…” and withdrew the princely sum of 49.5 million USD Coin (USDC). The stolen treasure was swiftly exchanged for Dai (DAI) and used to procure 17,696 Ethereum (ETH). Lookonchain later reported that the Ethereum was whisked away to a new wallet, “0xfcc8…6e49.” Following this grand heist, Infini’s co-founder reassured customers that they would be reimbursed. How noble!

According to the wise sages at Cyvers, the exploit was a result of a developer retaining admin rights during the smart contract setup. Three months later, this developer, perhaps feeling a bit too powerful, drained the funds to a wallet funded through the notorious crypto mixer Tornado Cash. Thus, the breach was revealed to be a consequence of a compromised private key, rather than a flaw in the wallet infrastructure, unlike the infamous Bybit hack. A tale as old as time!

🚨ALERT🚨Today, @0xinfini suffered a $49M $USDC exploit due to an attacker abusing retained administrative privileges.

The attacker, operating from 0xc49b5e5b9da66b9126c1a62e9761e6b2147de3e1, had initially developed the contract as part of the Infini project. However, after…

— 🚨 Cyvers Alerts 🚨 (@CyversAlerts) February 24, 2025

Read More

2025-03-03 15:36