Stablecoin payments platform Infini lost $50 million in an exploit believed to be carried out by a developer who retained admin privileges after completing work on the project, blockchain security firm Cyvers reported.
The attacker funded the exploit wallet with 1 ETH through crypto mixer Tornado Cash before withdrawing $49.52 million in USDC from Infini via a contract they deployed in November 2024. The stolen funds were swapped for Dai (DAI)—a stablecoin that lacks a freeze function and is often used by cybercriminals to evade asset seizures – then converted into 17,696 ETH and moved to a secondary address.
Despite the breach, Infini did not halt withdrawals. Founder Christian Li said the platform had already seen $500,000 in withdrawals since the attack and promised full compensation in a worst-case scenario.
A now-deleted tweet from an Infini team member claimed that the engineer behind the theft had been identified and reported to authorities, though official confirmation remains pending.
The Infini breach follows Bybit’s $1.4 billion hack, the largest in crypto history. The exchange kept withdrawals open and secured loans to meet $5 billion in customer withdrawals, eventually covering its Ether deficit by Feb. 24.
Blockchain analyst ZachXBT linked the Bybit hacker to North Korea’s Lazarus Group, which has been tied to previous attacks on Phemex and BingX.
Recent blockchain activity shows Ethereum from the $1.4 billion Bybit hack has been sent to multiple DEXs, including Sky (formerly MakerDAO), Uniswap, and OKX DEX. One transaction traced by copy trading platform LMK revealed that the hacker sent $3.64 million worth of ETH to an address, which was then converted into DAI.
A portion of the hacker’s DAI holdings has been split into multiple wallets, with some funds landing on eXch, a non-Know Your Customer (KYC) crypto exchange. Unlike other platforms that collaborated with Bybit to freeze compromised funds, eXch refused to take action.
