Infini hack — February 2025

On 24 February 2025 an address holding an administrative role over the vault where Infini kept customer deposits withdrew 49.5 million USDC in two transactions, roughly $11.45 million followed by about $38.06 million, and immediately converted the proceeds into DAI and then into approximately 17,696 ETH. The funds sat in the Morpho MEVCapital USDC Vault. Infini is a Hong Kong-based neobank that issued stablecoin payment cards and held customer deposits on chain.

Accounts of the mechanism differ in one respect. Cyvers, as reported by CoinDesk, found that a developer who helped set the contract up retained admin rights over it and used them more than three months later to drain the funds. QuillAudits describes the same event as privilege abuse by a compromised key holding the privileged role rather than a retained one. Both agree the role was never revoked and that the withdrawal used a function the caller was authorised to call; no smart-contract bug was involved. Infini co-founder Christian Li said publicly that the company had been negligent in transferring contract authority once development finished, and denied that his own key had been compromised.

Infini kept deposits and withdrawals open, said user balances were unaffected, and committed to full compensation, with Li saying he would cover the loss from personal funds if necessary. The company offered the attacker 20 percent of the assets for returning the rest within 48 hours; nothing was returned. A Hong Kong civil claim filed on 24 March 2025 names developer Chen Shanxuan and three unidentified persons, seeks injunctive relief and was served by on-chain message. Those allegations are untested and no criminal charges have been reported.

The amount is close to exact because the theft was denominated in USDC. Some outlets rounded it to $49 million or $50 million.