Infini's $50M Milestone Celebration Cut Short by $49.5M USDC Heist

Neobank Infini, a stablecoin-focused platform, recently celebrated reaching a $50 million total value locked (TVL) milestone. However, the celebration was short-lived as the platform suffered a significant exploit, resulting in a loss of approximately $49.5 million in USDC.

Blockchain security firm Cyvers detected the breach less than a day after the TVL milestone was announced. According to blockchain analytics firm Lookonchain, the attacker swiftly converted the stolen USDC into DAI before using the funds to purchase 17,696 ETH. The assets were then transferred to a separate wallet, complicating recovery efforts.

Circle, the issuer of USDC, faced criticism for its slow response to the incident. Blockchain sleuth ZachXBT slammed the company for its delayed reaction, pointing out that the USDC wasn't fully sold for 40 minutes. This is not the first time ZachXBT has criticized Circle's slow response to malicious activities involving USDC.

The attack on Infini unfolded when an attacker, identified as "0xc49b5," exploited administrative privileges that were never relinquished after they initially worked on Infini's contract. Over 100 days later, the attacker funded their address using Tornado Cash to cover Ethereum gas fees, setting the stage for the breach. Infini's founder, Christian, admitted responsibility for the security lapse, noting that his private key was not compromised but that he had previously mishandled the transfer of authority.

Christian reassured users that the platform remains financially stable and is actively working to track and recover the stolen funds. He also pledged full compensation in the event of financial losses. This attack follows a series of high-profile crypto hacks, including the recent $1.5 billion theft from Bybit. The Infini breach highlights the risks of granting long-term administrative privileges to developers, who could later exploit the very systems they helped build.