INFINI MONEY

DESCRIPTION OF EVENTS

Infini Money is a crypto payment solution designed for the masses, allowing users to make instant crypto payments globally with the Infini Card. It offers daily interest on balances, democratizing access to premium yield opportunities without requiring a physical card. Infini Card users can pay at over 100 million merchants worldwide, both online and offline, using their digital assets, with compatibility for platforms like Apple Pay, Google Pay, and AliPay. Infini emphasizes security, with audited smart contracts and a licensed custody partner, Cobo, ensuring asset protection. The service is globally accessible, free of monthly or annual fees, and includes a virtual card, with a physical card launching soon.

Beneath the technical jargon and blockchain complexity lies a disappointingly simple truth about Infini's collapse.

A complete lack of basic access control hygiene. No mandatory privilege transfers. No time-based access expirations. No multi-signature requirements for critical functions.

The Infini situation ended in a major exploit where the platform lost $49.5 million due to a rogue developer who maintained admin privileges after completing their work. The hacker, who had patiently waited for months, drained funds from Infini’s vault using privileged access, then laundered the stolen funds through Tornado Cash, converting them to ETH.

"Just blind trust in a faceless developer who built a backdoor, bided their time, and struck when the vault was fattest."

11,455,666.712564 + 38,060,996.264534 = 49516662.977098 or 49517k USDC

"A friend once joked that I had been having too smooth sailing along the way. I said that I was always ready for the first disaster, but I didn’t expect that I would be the one to run into trouble right after bybit.

My personal private key has not been leaked, so there is no need to worry too much. I was negligent when transferring the authority before. It is ultimately my responsibility. This has sounded the alarm.

Thank you friends for your voice and support. There is no problem with liquidity. Full compensation can be paid and the funds are being traced.

I'm sorry to have worried everyone who trusted us. I know rebuilding trust will be a difficult process, but we won't give up."

Infini's founder, Christian, acknowledged his mistake in transferring authority to the developer and pledged to personally cover the losses, especially for significant investors. Despite his efforts, including offering 20% of the stolen amount for the return of funds, the situation ended in a loss for Infini. Many lessons have been highlighted including the importance of proper access control and security protocols. Industry analysts note a hard lesson about the risks of placing too much trust in developers.

The hacker continues to move and swap funds around, and appears to have no intention of engaging with the bounty offered.

Explore This Case Further On Our Wiki

Infini Money, a crypto payment solution, suffered a major exploit when a rogue developer retained admin privileges and drained $49.5 million from the platform. The hacker used the access to steal USDC, swapped it for DAI, and laundered it through Tornado Cash. Despite Infini's founder, Christian, acknowledging his mistake and pledging to cover the losses, including offering a 20% bounty for the return of funds. The hacker ignored the offer. The Infini Money project continues to operate with decreased confidence, and it appears that fund losses have been limited to the project investors. It appears that Christian remains on the hook for the loss personally.

Rekt - Infini - Rekt (Feb 28)
Transfer Of 1 ETH From TornadoCash To Hacker (Mar 3)
LookOnChain - "A newly created wallet spent 49.5M $DAI to buy 17,696 $ETH at $2,798 in the past hour." - Twitter/X (Mar 3)
yieldsandmore - "Seems like $50m of @0xinfini Earn Funds just got hacked, into Torn-sourced addy 0x3ac96134fb0e42a52d33045aee50b89790f05ed0. Funds were taken from Morpho MEVCapital Usual USDC Vault." - Twitter/X (Mar 3)
Infini Linktree (Mar 3)
Infini Money Homepage (Mar 3)
Christian - "A friend once joked that I had been having too smooth sailing along the way. I said that I was always ready for the first disaster, but I didn’t expect that I would be the one to run into trouble right after bybit." - Twitter/X Translation (Mar 3)
Infini Money - "We're aware of reports on a security compromise affecting Infini. We're deeply sorry for the concern this causes - our team is working around the clock to investigate and secure all systems at the moment." - Twitter/X (Mar 3)
Infini Money - "We’ve identified critical info regarding the exploit and we’re monitoring involved addresses." - Twitter/X (Mar 3)
Infini Money - "All Infini Card functions—transfers, deposits, withdrawals, and payments—are fully operational." - Twitter/X (Mar 3)
Transfer Of 11,455,666.712564 USDC From Infini To Hacker (Mar 3)
Transfer Of 38,060,996.264534 USDC From Infini To Hacker (Mar 3)
0xInfini Twitter (Mar 3)
Transfering ETH Funds To New Wallet By Hacker (Mar 3)

More case studies

ByBit Multi-Sig Cold Wallet
Not Cold Or Multi-Sig

1Inch Resolve Order Suffix
Integer Overflow Vulnerability