Infini Prepaid Payments Card Issuer Hacked

Infini, a prepaid payments card issuer that offers interest on deposited dollar stablecoins, recently warned a hacker that it had “gathered critical IP and device information” after losing almost all the value locked in its wallets.

According to Peckshield, the attacker drained $49.5 million from the Hong Kong-based neobank’s wallets. Infini had just reported reaching $50 million in total value locked on Sunday.

This exploit comes shortly after another major incident where Bybit, the second-largest cryptocurrency exchange by trading volume, was hacked, resulting in a loss of nearly $1.5 billion from its ether cold wallet.

In a blockchain transaction, Infini communicated with the hacker, stating: “We are closely monitoring the address involved and are prepared to take immediate action to freeze any stolen funds if necessary.” The company proposed to offer the hacker 20% of the stolen assets if they choose to return the funds, providing a 48-hour deadline for a resolution. Otherwise, Infini warned that it would continue its investigation alongside law enforcement.

According to Cyvers, the exploit was due to a developer’s decision to retain admin rights over the smart contract, which they exploited more than three months later to drain the funds, sending them to a wallet funded through the cryptocurrency mixer Tornado Cash.

Infini’s founder, Christian Li, has committed to cover the full loss from his personal finances and has taken responsibility for the incident.