On February 24, 2025, at approximately 10:24, Infini monitored an unusual flow of funds. The hackers stole funds through an attack and transferred them to address 0x3ac96134fb0e42a52d33045aee50b89790f05ed0. Subsequently, the attackers quickly converted approximately $49.5 million worth of assets into DAI, ETH, and further transferred the converted ETH to address 0xfcc8ad911976d752890f2140d9f4edd2c64a6e49.
Following the incident, the Infini team took immediate emergency response measures, including:
- conducting an in-depth investigation to track the flow of funds and liaising with security organizations and relevant partners.
- proactively contacting affected customers to inform them of the situation and ensure that their rights and interests are not affected.
- urgently deploy funds to ensure that all customers’ withdrawal requests can be processed normally.
As of 18:00 BST on February 26, 2025, the stolen funds are still at the above address and there is no sign of further transfer, the Infini platform is operating normally and all customers’ withdrawal requests have been met. The security team is continuing to track the flow of funds and is working with all parties to maximize efforts to recover losses.
Infini Incident Timeline
Due to Infini’s well-established internal funds monitoring system, the team responded quickly to minimize the loss and impact of the incident:
30 minutes after the incident
- Infini’s internal team first detected the abnormal flow of funds, quickly locked the suspect account, and traced the attack path based on the on-chain data.
1 hour after the incident - Project founder Christian and co-founder Christine promise to pay out the full amount of compensation to ensure the safety of user assets in major social media and user communities.
- The team quickly allocated $5 million of their own funds to Cobo Wallet to ensure that all users’ withdrawal requests were responded to in a timely manner.
- SlowMist, a blockchain security firm, stepped in to investigate and confirmed that the attackers were highly skilled, and made a preliminary assessment of the attack methodology.
2 hours after the incident - Founder Christian publicly stated that the incident was not due to the leakage of personal private keys, but an oversight in the process of transferring permissions, and re-emphasized his promise of full compensation.
6 hours after the incident - ZachXBT, a chain security analyst, posted an article on the X platform, pointing out that the stolen funds could not be fully realized within 40 minutes, and questioning USDC issuer Circle’s failure to intervene in a timely manner.
- Cyvers Alerts monitoring showed that the hackers exploited a historical privilege management vulnerability to secretly retain contract administrator privileges and launch the attack.
12 hours after the incident - Infini officials make a public offer to the hackers, offering a 20% bounty in return for the return of the stolen funds.
24 hours - Over 98% of affected users have been communicated with and all withdrawal requests have been responded to.
48 hours after the incident - The Infini team continued to optimize security measures and centralized the transfer of core funds to the most secure Cobo Wallet, ensuring that payments, transfers, withdrawals and other operations were all functioning normally.
- The emergency response within the office continued, with team members analyzing the data on the chain overnight and working closely with security companies and the judiciary to ensure that the investigation progressed smoothly.
- Currently, Infini is actively assisting the police and working with SlowMist, a blockchain security company, to conduct a judicial investigation and track funds on the chain, and significant progress has been made. Infini will provide a full report and description of the incident to the community once the investigation is complete.
Infini Project Update and Future Plans
It is worth noting that despite the attack, Infini’s core product functionality has continued to operate normally, and its R&D and operations have not been affected:
- The release of Apple Pay-enabled physical cards continues to progress as planned.
- The daily revenue mechanism is expected to be optimized in the next 3-4 weeks to ensure that the security of the Yield section meets the highest standards.
- Chain data shows that despite some TVLs fluctuating after the incident, the growth trend of new deposit addresses (new subscribers) is stable and the market remains confident in Infini.
- Community support for Infini is high, with fewer negative voices on social media, and community members generally recognize the team’s response and handling plan.
Special Thanks
Infini has received extensive support and goodwill from both inside and outside the industry. Du Jun, co-founder of ABCDE, has offered to provide $5 million to $10 million in financial support to help Infini’s platform operate soundly. In addition, a number of industry KOLs have also publicly expressed their solidarity with Infini, praising its transparency and responsiveness during the crisis.
Infini would like to express its sincere gratitude for this support, especially the understanding and support from the community, users and industry partners. The team promises to continue to do its utmost to ensure the security and stability of the platform and provide better financial services to users.
