Crypto Neobank Infini Loses $49M in Insider Attack

Infini, a crypto-focused neobank, has suffered a significant security breach, resulting in the loss of $49 million. The incident, suspected to be an inside job, has raised concerns about the security of the cryptocurrency industry.

The breach occurred when an attacker, believed to be a former developer with retained administrative access, exploited a vulnerability in Infini's internal system. The perpetrator, who had previously worked as an external contractor, kept their administrator rights hidden and used them to target the system over a period of more than 100 days.

The attacker initiated the transaction using TornadoCash, a privacy tool designed to obfuscate their identity. They then made a small withdrawal to cover gas fees before successfully stealing all available funds stored within Infini's system. The stolen funds were initially swapped to DAI before being converted to Ethereum (ETH).

The cryptocurrency industry faces expanding security risks due to this incident. Insider threats remain a significant concern for platforms that use smart contracts, particularly those without proper access control systems. To mitigate these risks, the industry needs more frequent security assessments and enhanced developer permission tracking.

The Infini breach is not an isolated incident. On February 21, leading cryptocurrency exchange Bybit experienced a $1.4 billion hack, which set a new record for stolen exchange funds. These incidents highlight the urgent need for stronger security measures in the crypto domain.

As the market continues to grow, companies must implement robust security platforms to prevent new incidents. Scheduled evaluations, dual authorizations, and enhanced supervision are among the measures that can help strengthen security. Investors and users should also maintain constant alertness when selecting crypto solutions to ensure they are using platforms with robust security systems.