Infini
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 12 → 53. Problems weighed by who is responsible: incidents the subject suffered −12.8, problems around the subject, caused by others −1.6; legitimacy credit long-running +2. Version history →
Why this score
| Every page starts at | 65 |
| Incidents it suffered (e.g. hacks) | -12.8 |
| Problems around it, caused by others | -1.6 |
| Long-running | +2 |
| Sum | 53 |
Score: 53/100 (kept between 0 and 100)
How scoring works →Summary
Infini is a Hong Kong-based stablecoin neobank offering yield-bearing accounts and a global payment card. On February 24, 2025, a former developer who had covertly retained administrative privileges over Infini's smart contracts drained approximately $49.5 million in USDC from the Morpho MEVCapital vault, converting the funds to ETH and routing them through Tornado Cash. As of May 2026, no funds have been recovered, and the attacker's wallet remained active through at least February 2026.
Connected Entities
3 entities · 60 linked investigations- Uniswap→mentioned with→Ethereum(80%)
- Infini→mentioned with→Ethereum(60%)
- Infini→mentioned with→Uniswap(65%)
Timeline(8 events)
November 2024
Alleged creation of malicious contract by the developer approximately 114 days before the attack; attacker retains role 0x8e0b (privileged admin) over Infini vault contracts after completing contracted work.
24 February 2025
Attacker funds exploit wallet with 1 ETH from Tornado Cash. Two transactions drain approximately $49.5 million in USDC from the Morpho MEVCapital USDC Vault. Stolen USDC is swapped to DAI on Uniswap and converted to 17,696 ETH (~$49.5M). Funds transferred to wallet 0xfcc8ad911976d752890f2140d9f4edd2c64a6e49. CertiK flags the exploit at 3:18 am UTC.
24 February 2025
Infini founder Christian Li acknowledges the breach on X, accepts personal responsibility, pledges user compensation, and offers the attacker a 20% bounty to return 80% of stolen funds within 48 hours.
27 February 2025
48-hour bounty deadline elapses. Stolen funds remain in attacker's wallet. No contact from the attacker reported.
March 2025
Li publicly reaffirms the 20% bounty offer and extends an offer of legal immunity to the attacker. No response from attacker is reported.
July 2025
Exploiter's wallet deposits 5,000 ETH into Tornado Cash and sells 1,770 ETH for approximately $5.88 million at $3,322/ETH. PeckShield and CertiK flag the activity.
August 2025
Exploiter sells a further 1,771 ETH at approximately $4,202/ETH near a local cycle high.
9 February 2026
After more than 200 days of inactivity, the exploiter's wallet resurfaces, purchasing 6,316 ETH at an average of $2,109 (~$13.32M). The full balance is subsequently transferred to Tornado Cash. At least 15,470 ETH (~$32.7M) has now been routed through Tornado Cash. No funds recovered.
Decision Log
- slot 455369526 · hash 5Lwxxe1Xy1xEUWBrATdyPhMje3LzabyeQo4jcz5s3Hj1
- slot 420910774 · hash 7n6kobAbigzhVeY3G5yukfvzNacWA5fUp4uKV9Se2BTz
This investigation is cryptographically anchored to the Solana blockchain (2 decisions). 16 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:25 AM
last updated: 10/10/2026, 6:49:25 PM
5 viewsavoid.net — verified advice for a post-truth world