{"investigation":{"slug":"infini-protocol","entity_name":"Infini Protocol","trust_score":22,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Infini is a Hong Kong-based stablecoin neobank offering yield, payments, and enterprise treasury tools built on DeFi infrastructure. In February 2025, the platform suffered a $49.5 million exploit when a former contract developer who had secretly retained administrative privileges drained the Morpho MEVCapital USDC Vault across two transactions. Founder Christian Li pledged personal coverage of losses and offered a 20% bounty to the attacker; as of mid-2026 the stolen funds have not been recovered, with the exploiter laundering proceeds through Tornado Cash.","sections":[{"content":"Infini describes itself as an AI-powered financial operating system and stablecoin digital bank targeting next-generation enterprises. Its core products include high-yield stablecoin savings (backed by DeFi vaults such as Morpho), global multi-currency accounts, cross-border remittance, fiat-to-crypto integration, and enterprise virtual cards. The platform is headquartered in Hong Kong and markets primarily to businesses seeking borderless financial infrastructure. Founder Christian Li, a post-2000s entrepreneur who entered crypto through NFTs and co-founded the fund NextGen Digital Ventures, launched Infini with the goal of bringing institutional DeFi yields to a broader, non-technical user base. In May 2026, Infini secured a Money Services Business (MSB) registration with Canada's FINTRAC, covering foreign exchange, money transfer and remittance, and virtual currency services, indicating continued expansion despite the prior security incident.","heading":"Background and Product","sources":[{"url":"https://www.infini.money/","name":"infini.money","type":"other","credibility":3},{"url":"https://www.aicoin.com/en/article/465480","name":"aicoin.com","type":"other","credibility":3},{"url":"https://www.globenewswire.com/news-release/2026/05/01/3286168/0/en/Infini-Secures-MSB-Registration-in-Canada-Advancing-Its-Global-AI-Financial-Operating-System-for-Next-Generation-Enterprises.html","name":"globenewswire.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On February 24, 2025, Infini lost approximately $49.5 million in USDC in one of the largest DeFi exploits of that year. Security firms Cyvers, CertiK, PeckShield, and BlockSec identified the root cause as an access control failure: a former developer who had been contracted to deploy Infini's smart contracts secretly retained a privileged administrative role (function selector 0x8e0b) on the contract after the engagement concluded. This role granted the associated address the ability to withdraw all funds from the vault without additional authorization. The malicious contract used in the attack was deployed in November 2024, approximately 114 days before the exploit was executed, suggesting deliberate preparation. The attacker funded the exploit wallet with 1 ETH sourced from Tornado Cash to obscure origins, then executed two drain transactions — one for approximately $11.45 million and a second for approximately $38.06 million — targeting the Morpho MEVCapital USDC Vault. No flash loans or price manipulation were involved; the attack relied entirely on pre-embedded administrative access. Founder Christian Li later acknowledged that the breach was not a private key leak but resulted from his own negligence in failing to revoke or transfer developer authority after contract deployment.","heading":"The February 2025 Exploit — Access Control Failure","sources":[{"url":"https://rekt.news/infini-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-infini-hack-february-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://decrypt.co/307513/crypto-neo-bank-infini-50-million-exploit","name":"decrypt.co","type":"other","credibility":3},{"url":"https://www.coindesk.com/markets/2025/02/24/payments-card-issuer-infini-offers-reward-for-return-of-funds-after-usd49-million-exploit","name":"coindesk.com","type":"other","credibility":3},{"url":"https://coinjournal.net/news/what-we-know-about-the-49-5-million-infini-exploit-so-far/","name":"coinjournal.net","type":"other","credibility":3}],"severity":"medium"},{"content":"Immediately following the two USDC withdrawals, the exploiter converted the stolen USDC to DAI — a stablecoin without a central freeze mechanism — before swapping the DAI into approximately 17,696 ETH (valued at roughly $49 million at the time). The choice of DAI over USDC was deliberate, as USDC can be frozen by Circle. The ETH was transferred to a secondary address (0xfcC8Ad911976d752890f2140D9F4edd2c64a6e49). In subsequent months, the exploiter began routing proceeds through Tornado Cash in multiple tranches: an initial movement of 3,000 ETH was followed by a larger transfer of approximately 15,470 ETH, and additional reported movements bringing the total laundered through Tornado Cash to approximately $32.7 million. In early 2026, the hacker reportedly purchased an additional 6,316 ETH and immediately routed those funds into Tornado Cash as well. Separately, blockchain observers noted the exploiter used some proceeds to buy ETH during market dips, including a reported $13 million ETH purchase. As of mid-2026, no portion of the stolen funds has been recovered or frozen.","heading":"Fund Movement and Laundering","sources":[{"url":"https://rekt.news/infini-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.livebitcoinnews.com/suspected-infini-hacker-routes-32-7m-in-eth-through-tornado-cash/","name":"livebitcoinnews.com","type":"other","credibility":3},{"url":"https://cryptorank.io/news/feed/d350b-infini-hacker-eth-laundering-tornado","name":"cryptorank.io","type":"other","credibility":3},{"url":"https://crypto.news/infini-exploiter-resurfaces-to-buy-eth-dip/","name":"crypto.news","type":"other","credibility":3},{"url":"https://crypto-economy.com/infini-hacker-launders-millions-using-tornado-cash-amid-regulatory-heat/","name":"crypto-economy.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Within hours of the exploit, Infini founder Christian Li publicly accepted responsibility, stating: 'I was negligent when transferring the authority before. It is ultimately my responsibility.' He pledged to cover the full $49.5 million loss from his personal funds if the stolen assets could not be recovered, and confirmed that the platform continued to process user deposits and withdrawals normally. Infini formally offered the attacker a 20% reward — approximately $9.9 million — and legal immunity in exchange for the return of the remaining 80%. This offer was accompanied by a 48-hour ultimatum and a statement that Infini was prepared to freeze any on-chain funds if possible and would involve law enforcement otherwise. The founder also reaffirmed the bounty in a later public post offering legal immunity and no legal proceedings. On August 11, 2025, Infini issued what was described as a final ultimatum, giving the hacker until August 13, 2025 at 20:00 GMT+8 to return the full $49.5 million. The exploiter did not comply. There is no public record of any funds having been returned as of May 2026.","heading":"Founder Response and Bounty Offers","sources":[{"url":"https://www.coindesk.com/markets/2025/02/24/payments-card-issuer-infini-offers-reward-for-return-of-funds-after-usd49-million-exploit","name":"coindesk.com","type":"other","credibility":3},{"url":"https://crypto.news/infini-founder-reaffirms-20-bounty-and-legal-immunity-to-infini-hacker-for-return-of-stolen-funds/","name":"crypto.news","type":"other","credibility":3},{"url":"https://bitcoinethereumnews.com/finance/infini-offers-hacker-9-9m-to-return-stolen-funds/","name":"bitcoinethereumnews.com","type":"other","credibility":3},{"url":"https://defi-planet.com/2025/03/infini-founder-appeals-to-hacker-with-bounty-offer-following-49-5m-heist/","name":"defi-planet.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Security researchers from Halborn, QuillAudits, and Cyvers identified several compounding failures in Infini's smart contract governance. The deployed contract was unverified — no corresponding source code was published on-chain or on GitHub — which prevented independent auditors from identifying the embedded privileged role prior to the attack. The special administrative role (0x8e0b) was never revoked or transferred after the contracting developer completed their engagement, representing a critical access management failure. Security experts noted that standard mitigations — including multi-signature wallets for privileged operations, mandatory post-launch access revocation procedures, and smart contract verification requirements — were absent. The 114-day gap between contract deployment and the attack suggests the developer intentionally waited for the vault to accumulate a significant balance. Halborn specifically noted that off-chain security practices, not just code-level audits, must be part of any DeFi project's security posture. The co-founder known as @0xsexybanana allegedly deleted her X account shortly after the exploit, according to some reports, though this claim originates from social media and has not been independently confirmed by a Tier 1 or 2 source.","heading":"Security Failures and Technical Analysis","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-infini-hack-february-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://www.quillaudits.com/blog/hack-analysis/how-infini-lost-49-million-in-a-defi-hack","name":"quillaudits.com","type":"other","credibility":3},{"url":"https://rekt.news/infini-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://coinjournal.net/news/what-we-know-about-the-49-5-million-infini-exploit-so-far/","name":"coinjournal.net","type":"other","credibility":3}],"severity":"medium"},{"content":"Despite the $49.5 million exploit, Infini has continued to operate and expand. Infini's founder confirmed that user withdrawals, deposits, and transfers remained functional in the immediate aftermath of the hack. As of May 2026, Infini obtained an MSB registration from Canada's FINTRAC, authorizing it to provide foreign exchange, money transfer and remittance, and virtual currency services in Canada. The company now describes itself as an 'AI-powered financial operating system' for next-generation enterprises, positioning itself beyond a simple yield protocol. No public confirmation has been issued as to whether the founder's pledged personal coverage of user losses was formally executed, nor whether any users experienced net losses. No SEC, CFTC, DOJ, or equivalent regulatory enforcement actions have been identified in connection with the February 2025 exploit as of the research date.","heading":"Ongoing Operations and Regulatory Status","sources":[{"url":"https://www.globenewswire.com/news-release/2026/05/01/3286168/0/en/Infini-Secures-MSB-Registration-in-Canada-Advancing-Its-Global-AI-Financial-Operating-System-for-Next-Generation-Enterprises.html","name":"globenewswire.com","type":"other","credibility":3},{"url":"https://decrypt.co/307513/crypto-neo-bank-infini-50-million-exploit","name":"decrypt.co","type":"other","credibility":3},{"url":"https://www.bankinfosecurity.com/cryptohack-roundup-49m-infini-exploit-a-27613","name":"bankinfosecurity.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2024-11","event":"Malicious exploiter contract deployed by the former developer, embedding a privileged admin role (0x8e0b) approximately 114 days before the attack.","source":"","date_original":"2024-11-01"},{"date":"2025-02-23","event":"Exploit initiated late Sunday evening. Attacker funded wallet with 1 ETH from Tornado Cash and drained $11.45 million in USDC from Morpho MEVCapital vault (first transaction).","source":""},{"date":"2025-02-24","event":"Second drain of $38.06 million USDC executed; total stolen reaches approximately $49.5 million. Stolen USDC converted to DAI, then swapped to roughly 17,696 ETH. Cyvers, PeckShield, and CertiK detect and report the exploit. Infini acknowledges the breach approximately 8 hours after initial detection.","source":""},{"date":"2025-02-24","event":"Founder Christian Li publicly accepts personal responsibility and pledges to cover all losses. Infini offers the attacker a 20% bounty (~$9.9M) and legal immunity for return of funds within 48 hours.","source":""},{"date":"2025-03","event":"Christian Li reaffirms 20% bounty offer and legal immunity. No funds have been returned.","source":"","date_original":"2025-03-01"},{"date":"2025-07-17","event":"Alleged Infini hacker moves 3,000 ETH through Tornado Cash in the first identified laundering tranche post-exploit.","source":""},{"date":"2025-08-11","event":"Infini issues a final ultimatum to the hacker, demanding return of the full $49.5 million by August 13, 2025 at 20:00 GMT+8. The deadline passes without compliance.","source":""},{"date":"2026-02","event":"Alleged exploiter purchases approximately 6,316 ETH and immediately routes proceeds into Tornado Cash, per PeckShield and CertiK monitoring.","source":"","date_original":"2026-02-01"},{"date":"2026-05","event":"Infini secures MSB registration with Canada's FINTRAC, covering foreign exchange, money transfer, remittance, and virtual currency services, signaling continued business operations.","source":"","date_original":"2026-05-01"}],"sources_used":[{"url":"https://www.infini.money/","name":"infini.money","type":"other","credibility":3},{"url":"https://www.aicoin.com/en/article/465480","name":"aicoin.com","type":"other","credibility":3},{"url":"https://www.globenewswire.com/news-release/2026/05/01/3286168/0/en/Infini-Secures-MSB-Registration-in-Canada-Advancing-Its-Global-AI-Financial-Operating-System-for-Next-Generation-Enterprises.html","name":"globenewswire.com","type":"other","credibility":3},{"url":"https://rekt.news/infini-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-infini-hack-february-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://decrypt.co/307513/crypto-neo-bank-infini-50-million-exploit","name":"decrypt.co","type":"other","credibility":3},{"url":"https://www.coindesk.com/markets/2025/02/24/payments-card-issuer-infini-offers-reward-for-return-of-funds-after-usd49-million-exploit","name":"coindesk.com","type":"other","credibility":3},{"url":"https://coinjournal.net/news/what-we-know-about-the-49-5-million-infini-exploit-so-far/","name":"coinjournal.net","type":"other","credibility":3},{"url":"https://www.livebitcoinnews.com/suspected-infini-hacker-routes-32-7m-in-eth-through-tornado-cash/","name":"livebitcoinnews.com","type":"other","credibility":3},{"url":"https://cryptorank.io/news/feed/d350b-infini-hacker-eth-laundering-tornado","name":"cryptorank.io","type":"other","credibility":3},{"url":"https://crypto.news/infini-exploiter-resurfaces-to-buy-eth-dip/","name":"crypto.news","type":"other","credibility":3},{"url":"https://crypto-economy.com/infini-hacker-launders-millions-using-tornado-cash-amid-regulatory-heat/","name":"crypto-economy.com","type":"other","credibility":3},{"url":"https://crypto.news/infini-founder-reaffirms-20-bounty-and-legal-immunity-to-infini-hacker-for-return-of-stolen-funds/","name":"crypto.news","type":"other","credibility":3},{"url":"https://bitcoinethereumnews.com/finance/infini-offers-hacker-9-9m-to-return-stolen-funds/","name":"bitcoinethereumnews.com","type":"other","credibility":3},{"url":"https://defi-planet.com/2025/03/infini-founder-appeals-to-hacker-with-bounty-offer-following-49-5m-heist/","name":"defi-planet.com","type":"other","credibility":3},{"url":"https://www.quillaudits.com/blog/hack-analysis/how-infini-lost-49-million-in-a-defi-hack","name":"quillaudits.com","type":"other","credibility":3},{"url":"https://www.bankinfosecurity.com/cryptohack-roundup-49m-infini-exploit-a-27613","name":"bankinfosecurity.com","type":"other","credibility":3}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-30T19:10:23.557673+00:00","updated_at":"2026-08-29T01:34:24.046+00:00"}}