Infini Protocol
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·3dGTru…cYbtSummary
Infini is a Hong Kong-based stablecoin neobank offering yield, payments, and enterprise treasury tools built on DeFi infrastructure. In February 2025, the platform suffered a $49.5 million exploit when a former contract developer who had secretly retained administrative privileges drained the Morpho MEVCapital USDC Vault across two transactions. Founder Christian Li pledged personal coverage of losses and offered a 20% bounty to the attacker; as of mid-2026 the stolen funds have not been recovered, with the exploiter laundering proceeds through Tornado Cash.
Connected Entities
1 entitiesTimeline(9 events)
November 2024
Malicious exploiter contract deployed by the former developer, embedding a privileged admin role (0x8e0b) approximately 114 days before the attack.
23 February 2025
Exploit initiated late Sunday evening. Attacker funded wallet with 1 ETH from Tornado Cash and drained $11.45 million in USDC from Morpho MEVCapital vault (first transaction).
24 February 2025
Second drain of $38.06 million USDC executed; total stolen reaches approximately $49.5 million. Stolen USDC converted to DAI, then swapped to roughly 17,696 ETH. Cyvers, PeckShield, and CertiK detect and report the exploit. Infini acknowledges the breach approximately 8 hours after initial detection.
24 February 2025
Founder Christian Li publicly accepts personal responsibility and pledges to cover all losses. Infini offers the attacker a 20% bounty (~$9.9M) and legal immunity for return of funds within 48 hours.
March 2025
Christian Li reaffirms 20% bounty offer and legal immunity. No funds have been returned.
17 July 2025
Alleged Infini hacker moves 3,000 ETH through Tornado Cash in the first identified laundering tranche post-exploit.
11 August 2025
Infini issues a final ultimatum to the hacker, demanding return of the full $49.5 million by August 13, 2025 at 20:00 GMT+8. The deadline passes without compliance.
February 2026
Alleged exploiter purchases approximately 6,316 ETH and immediately routes proceeds into Tornado Cash, per PeckShield and CertiK monitoring.
May 2026
Infini secures MSB registration with Canada's FINTRAC, covering foreign exchange, money transfer, remittance, and virtual currency services, signaling continued business operations.
Decision Log
- hash: CxMgg9iMyWrjtCzHVXEDDogQpGf8987Z3LKkdRiqFMuW
This investigation is cryptographically anchored to the Solana blockchain (1 event). 0 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/30/2026, 7:10:23 PM
last updated: 8/29/2026, 1:34:24 AM
avoid.net — verified advice for a post-truth world