Injective (binary options settlement) hack — August 2026

Injective's layer-1 stopped producing blocks for three hours and forty-two minutes on 31 August 2026 while its validators shipped an emergency patch. Researchers put the amount taken at about $4.9m.

The defect was in how the chain names its markets. A market identifier was derived by concatenating oracleType, ticker, quoteDenom, oracleSymbol and oracleProvider with no separators and no length prefixes, so different combinations of fields could produce the same identifier. The attacker used that to make an INJ-denominated insurance fund collide with the identifier of a USDC-denominated binary options market. At settlement the chain looked up the fund under that identifier, found a trivial INJ balance, and treated it as sufficient cover for a dollar-denominated shortfall, skipping the haircuts that exist for precisely this case and releasing full withdrawals.

Getting there took the rest of the setup. Binary options markets could be created permissionlessly, and the attacker created 299 of them, each pointed at an oracle they controlled and had configured never to return a price. A missing price at settlement falls through to a refund path. Expiry and settlement timestamps were set seconds apart, and trades were self-matched between the attacker's own subaccounts at prices they chose. One documented cycle turned roughly 105,000 USDC of deposits into more than 204,000 USDC of withdrawals, and the cycle was repeated.

Block production had already degraded to intervals of about thirty-seven minutes before it stopped after block 181,027,005 at 16:09:59 UTC. The chain advanced exactly one block between 16:10 and 19:52 UTC. The emergency release v1.20.3-safeharbor.1 added an insurance-fund denomination check and disabled binary-options settlement on mainnet. Nothing was reversed, a deliberate contrast with Cronos, which the previous day discarded 10,961 blocks to undo the Tectonic theft recorded elsewhere in this registry.

The $4.9m is DefimonAlerts's on-chain estimate, measured as roughly 1,980 ETH bridged to Ethereum during the incident; the researcher Paddy noted that approximately that amount was still sitting unmoved in the attacker-linked wallet. PeckShield's separate monthly tally put the figure at $4.8m. Injective has confirmed neither.

On 1 September the foundation said the chain had been upgraded rather than halted, that consensus, native INJ and staked assets were never compromised, and that the impact was confined to a small number of ecosystem applications using binary-options markets. CEO Eric Chen said Injective users were not affected. No full technical post-mortem has been published, no final loss figure has been given, and it has not been said who absorbed the shortfall. Metaverse Post additionally reported that the injective-core and injective-chain repositories were taken down from GitHub; that account rests on that publisher alone.

A separate matter, recorded here so that the two are not merged: in June 2026 a compromised account published a malicious build of the Injective TypeScript SDK to npm that hooked key-derivation functions to exfiltrate private keys. It was live for under an hour, was downloaded roughly 310 times, and no theft was ever reported. It falls below this registry's threshold and has no entry.