Stablecoin Bank Infini Hit by $49.5M Exploit, Founder Vows Full Repayment

Following the $1.4 billion Bybit hack on Friday, Hong Kong-based stablecoin digital bank Infini suffered a security breach, losing nearly $50 million in USDC. Initial reports suggest that the hacker used private keys to steal $49.5 million in USDC, swapped it for DAI, then converted it to ETH via the crypto mixer Tornado Cash, and deposited it into a new address, according to PeckShield.

The hacker exploited a single private key to drain funds from the platform’s vault. According to Etherscan, the attacker stole a total of $49.5 million in two batches, 11,455,666 USDC and 38,060,996 USDC.

The attacker was originally involved in developing the contract for the Infini project. However, after delivering the project, they secretly retained admin rights. More than 100 days later, the attacker funded their address through Tornado Cash, sent a small ETH transaction for gas, and exploited the contract—draining all funds from the platform.

#PeckShieldAlert The #Infini hacker has swapped 49.5M $DAI for ~17.7K $ETH and transferred to a new address 0xfcc8a…6e49 pic.twitter.com/j70rXIVOUM

— PeckShieldAlert (@PeckShieldAlert) February 24, 2025

Infini Founder Promises Full Compensation

Infini founder Christian Li responded to the hack, assuring users that the team is actively investigating and tracking the incident. He confirmed that user withdrawals remain unaffected and emphasized that, even in the worst-case scenario, full compensation will be provided. “Users can rest assured,” Christian stated, reaffirming the platform’s commitment to resolving the situation.

Christian also reported that s​​uspected hacker’s computer was located and reported to the police. He added,” My personal private key has not been leaked, so there is no need to worry too much. I was negligent when transferring the authority before. It is ultimately my responsibility. This has sounded the alarm.”