Infini Protocol
Summary
Infini is a Hong Kong-based stablecoin neobank offering yield, payments, and enterprise treasury tools built on DeFi infrastructure. In February 2025, the platform suffered a $49.5 million exploit when a former contract developer who had secretly retained administrative privileges drained the Morpho MEVCapital USDC Vault across two transactions. Founder Christian Li pledged personal coverage of losses and offered a 20% bounty to the attacker; as of mid-2026 the stolen funds have not been recovered, with the exploiter laundering proceeds through Tornado Cash.
Connected Entities
1 entitiesTimeline(9 events)
2024-11-01
Malicious exploiter contract deployed by the former developer, embedding a privileged admin role (0x8e0b) approximately 114 days before the attack.
2025-02-23
Exploit initiated late Sunday evening. Attacker funded wallet with 1 ETH from Tornado Cash and drained $11.45 million in USDC from Morpho MEVCapital vault (first transaction).
2025-02-24
Second drain of $38.06 million USDC executed; total stolen reaches approximately $49.5 million. Stolen USDC converted to DAI, then swapped to roughly 17,696 ETH. Cyvers, PeckShield, and CertiK detect and report the exploit. Infini acknowledges the breach approximately 8 hours after initial detection.
2025-02-24
Founder Christian Li publicly accepts personal responsibility and pledges to cover all losses. Infini offers the attacker a 20% bounty (~$9.9M) and legal immunity for return of funds within 48 hours.
2025-03-01
Christian Li reaffirms 20% bounty offer and legal immunity. No funds have been returned.
2025-07-17
Alleged Infini hacker moves 3,000 ETH through Tornado Cash in the first identified laundering tranche post-exploit.
2025-08-11
Infini issues a final ultimatum to the hacker, demanding return of the full $49.5 million by August 13, 2025 at 20:00 GMT+8. The deadline passes without compliance.
2026-02-01
Alleged exploiter purchases approximately 6,316 ETH and immediately routes proceeds into Tornado Cash, per PeckShield and CertiK monitoring.
2026-05-01
Infini secures MSB registration with Canada's FINTRAC, covering foreign exchange, money transfer, remittance, and virtual currency services, signaling continued business operations.
Decision Log
- hash: CxMgg9iMyWrjtCzHVXEDDogQpGf8987Z3LKkdRiqFMuW
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/30/2026, 7:10:23 PM
last updated: 5/30/2026, 7:10:25 PM
avoid.net — verified advice for a post-truth world