Infini, a DeFi platform, lost $49 million in USDC due to a smart contract vulnerability caused by retained developer access. The incident highlights security issues in cryptocurrencies.
Details and Causes of the Exploit
The $49 million exploit occurred due to an administrator's access to Infini's smart contract, allowing the attacker to drain the platform's funds. Infini disclosed that the exploit was linked to retained developer access but has not yet released details on the flaw. Infini, which offered high-yield neobank services, unexpectedly fell victim to its own yield products.
Actions After the Attack
Following the exploit, the attacker converted the stolen USDC into 17,696 ETH, complicating the freezing of funds. These operations were conducted through decentralized protocols like Uniswap and Sky Protocol. The funds were split into smaller sums across various addresses, complicating traceability. To cover these transactions, the attacker used Tornado Cash, hindering tracking efforts.
Analysis and Impact
The exploit raised doubts about Infini's reliability and possible personal key leaks. Although Infini has not halted operations, the project's founder, @christianeth, took full responsibility for the flaw, stating readiness to compensate users. The incident raises concerns about potential attacks from the Lazarus group, known for stealing cryptocurrency funds. Some also suspect insider involvement familiar with the contract.
The Infini incident underscores the importance of thorough security and access verification in DeFi projects. This case may influence the crypto market, highlighting community concerns about security issues.
