Summary
Infini is a Hong Kong-based stablecoin neobank offering yield-bearing accounts and a global payment card. On February 24, 2025, a former developer who had covertly retained administrative privileges over Infini's smart contracts drained approximately $49.5 million in USDC from the Morpho MEVCapital vault, converting the funds to ETH and routing them through Tornado Cash. As of May 2026, no funds have been recovered, and the attacker's wallet remained active through at least February 2026.
Connected Entities
1 entitiesTimeline(8 events)
2024-11-01
Alleged creation of malicious contract by the developer approximately 114 days before the attack; attacker retains role 0x8e0b (privileged admin) over Infini vault contracts after completing contracted work.
2025-02-24
Attacker funds exploit wallet with 1 ETH from Tornado Cash. Two transactions drain approximately $49.5 million in USDC from the Morpho MEVCapital USDC Vault. Stolen USDC is swapped to DAI on Uniswap and converted to 17,696 ETH (~$49.5M). Funds transferred to wallet 0xfcc8ad911976d752890f2140d9f4edd2c64a6e49. CertiK flags the exploit at 3:18 am UTC.
2025-02-24
Infini founder Christian Li acknowledges the breach on X, accepts personal responsibility, pledges user compensation, and offers the attacker a 20% bounty to return 80% of stolen funds within 48 hours.
2025-02-27
48-hour bounty deadline elapses. Stolen funds remain in attacker's wallet. No contact from the attacker reported.
2025-03-01
Li publicly reaffirms the 20% bounty offer and extends an offer of legal immunity to the attacker. No response from attacker is reported.
2025-07-01
Exploiter's wallet deposits 5,000 ETH into Tornado Cash and sells 1,770 ETH for approximately $5.88 million at $3,322/ETH. PeckShield and CertiK flag the activity.
2025-08-01
Exploiter sells a further 1,771 ETH at approximately $4,202/ETH near a local cycle high.
2026-02-09
After more than 200 days of inactivity, the exploiter's wallet resurfaces, purchasing 6,316 ETH at an average of $2,109 (~$13.32M). The full balance is subsequently transferred to Tornado Cash. At least 15,470 ETH (~$32.7M) has now been routed through Tornado Cash. No funds recovered.
Decision Log
- hash: 7n6kobAbigzhVeY3G5yukfvzNacWA5fUp4uKV9Se2BTz
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:25 AM
last updated: 5/20/2026, 4:09:24 AM
avoid.net — verified advice for a post-truth world