Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·3QT6VY…jJE8Summary
Infini is a Hong Kong-based stablecoin neobank offering yield-bearing accounts and a global payment card. On February 24, 2025, a former developer who had covertly retained administrative privileges over Infini's smart contracts drained approximately $49.5 million in USDC from the Morpho MEVCapital vault, converting the funds to ETH and routing them through Tornado Cash. As of May 2026, no funds have been recovered, and the attacker's wallet remained active through at least February 2026.
Connected Entities
1 entitiesTimeline(8 events)
November 2024
Alleged creation of malicious contract by the developer approximately 114 days before the attack; attacker retains role 0x8e0b (privileged admin) over Infini vault contracts after completing contracted work.
24 February 2025
Attacker funds exploit wallet with 1 ETH from Tornado Cash. Two transactions drain approximately $49.5 million in USDC from the Morpho MEVCapital USDC Vault. Stolen USDC is swapped to DAI on Uniswap and converted to 17,696 ETH (~$49.5M). Funds transferred to wallet 0xfcc8ad911976d752890f2140d9f4edd2c64a6e49. CertiK flags the exploit at 3:18 am UTC.
24 February 2025
Infini founder Christian Li acknowledges the breach on X, accepts personal responsibility, pledges user compensation, and offers the attacker a 20% bounty to return 80% of stolen funds within 48 hours.
27 February 2025
48-hour bounty deadline elapses. Stolen funds remain in attacker's wallet. No contact from the attacker reported.
March 2025
Li publicly reaffirms the 20% bounty offer and extends an offer of legal immunity to the attacker. No response from attacker is reported.
July 2025
Exploiter's wallet deposits 5,000 ETH into Tornado Cash and sells 1,770 ETH for approximately $5.88 million at $3,322/ETH. PeckShield and CertiK flag the activity.
August 2025
Exploiter sells a further 1,771 ETH at approximately $4,202/ETH near a local cycle high.
9 February 2026
After more than 200 days of inactivity, the exploiter's wallet resurfaces, purchasing 6,316 ETH at an average of $2,109 (~$13.32M). The full balance is subsequently transferred to Tornado Cash. At least 15,470 ETH (~$32.7M) has now been routed through Tornado Cash. No funds recovered.
Decision Log
- hash: 7n6kobAbigzhVeY3G5yukfvzNacWA5fUp4uKV9Se2BTz
This investigation is cryptographically anchored to the Solana blockchain (1 event). 16 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:25 AM
last updated: 8/30/2026, 3:55:00 AM
avoid.net — verified advice for a post-truth world