Infini, a Hong Kong-based stablecoin neobank, was hacked for $49.5 million in USDC and swapped for 17,696 ETH.
The attacker exploited retained admin privileges in Infini's smart contract, manipulating settings to drain the funds.
Infini's founder acknowledged the breach, attributing it to negligence in authority transfer and promised full compensation.
The attack, discovered by CertiK, has highlighted vulnerabilities in DeFi, following the recent Bybit hack.
The hacker converted the stolen USDC to Dai and purchased 17,696 Ethereum, transferring funds to a new wallet, splitting them across multiple addresses.
Infini reassured users that all transactions are functioning normally despite the security breach.
The incident raises concerns about private key management, smart contract security, and insider threats in DeFi platforms.
Infini's growth and attractive high-yield products inadvertently facilitated the exploit, amplifying its financial impact.
Speculations link the Lazarus hacker group to the exploit, similar to the Bybit hack, prompting calls for enhanced security measures in crypto platforms.
The stolen ETH influx boosted Ethereum's price temporarily, while concerns about money laundering and hostile financing emerged due to Tornado Cash use and theft scale.