Infini Protocol
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 22 → 55. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −3.2, problems around the subject, caused by others −2.4; legitimacy credit long-running +2. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -3.2 |
| Incidents it suffered (e.g. hacks) | -6.4 |
| Problems around it, caused by others | -2.4 |
| Long-running | +2 |
| Sum | 55 |
Score: 55/100 (kept between 0 and 100)
How scoring works →Summary
Infini is a Hong Kong-based stablecoin neobank offering yield, payments, and enterprise treasury tools built on DeFi infrastructure. In February 2025, the platform suffered a $49.5 million exploit when a former contract developer who had secretly retained administrative privileges drained the Morpho MEVCapital USDC Vault across two transactions. Founder Christian Li pledged personal coverage of losses and offered a 20% bounty to the attacker; as of mid-2026 the stolen funds have not been recovered, with the exploiter laundering proceeds through Tornado Cash.
Connected Entities
2 entities · 2 linked investigations- Infini Protocol→mentioned with→Infini(70%)
Connected Through
1 shared actor · 2 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- ⌂Infiniprotocol
Timeline(9 events)
November 2024
Malicious exploiter contract deployed by the former developer, embedding a privileged admin role (0x8e0b) approximately 114 days before the attack.
23 February 2025
Exploit initiated late Sunday evening. Attacker funded wallet with 1 ETH from Tornado Cash and drained $11.45 million in USDC from Morpho MEVCapital vault (first transaction).
24 February 2025
Second drain of $38.06 million USDC executed; total stolen reaches approximately $49.5 million. Stolen USDC converted to DAI, then swapped to roughly 17,696 ETH. Cyvers, PeckShield, and CertiK detect and report the exploit. Infini acknowledges the breach approximately 8 hours after initial detection.
24 February 2025
Founder Christian Li publicly accepts personal responsibility and pledges to cover all losses. Infini offers the attacker a 20% bounty (~$9.9M) and legal immunity for return of funds within 48 hours.
March 2025
Christian Li reaffirms 20% bounty offer and legal immunity. No funds have been returned.
17 July 2025
Alleged Infini hacker moves 3,000 ETH through Tornado Cash in the first identified laundering tranche post-exploit.
11 August 2025
Infini issues a final ultimatum to the hacker, demanding return of the full $49.5 million by August 13, 2025 at 20:00 GMT+8. The deadline passes without compliance.
February 2026
Alleged exploiter purchases approximately 6,316 ETH and immediately routes proceeds into Tornado Cash, per PeckShield and CertiK monitoring.
May 2026
Infini secures MSB registration with Canada's FINTRAC, covering foreign exchange, money transfer, remittance, and virtual currency services, signaling continued business operations.
Decision Log
- slot 455369340 · hash 9P227wXUMV6VadYEHYVxeerEHwzKQGTUZEG5SNJAXWPD
- slot 423217210 · hash CxMgg9iMyWrjtCzHVXEDDogQpGf8987Z3LKkdRiqFMuW
This investigation is cryptographically anchored to the Solana blockchain (2 decisions). 17 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/30/2026, 7:10:23 PM
last updated: 10/10/2026, 6:49:16 PM
5 viewsavoid.net — verified advice for a post-truth world