After Bybit, Hackers steal $49M from Infini Crypto Fintech

Another big crypto hack has rocked the industry. Infini, a crypto fintech company, lost $49 million in USDC, and the twist? The hacker was one of their own developers.

Blockchain security firm Cyvers revealed that the developer had secretly kept admin access to the project even after completing it. For over 100 days, there was no sign of trouble, but then out of nowhere, they funded their wallet through Tornado Cash, a crypto mixer often associated with suspicious activities.

🚨ALERT🚨Today, @0xinfini suffered a $49M $USDC exploit due to an attacker abusing retained administrative privileges.

The attacker, operating from 0xc49b5e5b9da66b9126c1a62e9761e6b2147de3e1, had initially developed the contract as part of the Infini project. However, after… pic.twitter.com/olguOyNCJr
— 🚨 Cyvers Alerts 🚨 (@CyversAlerts) February 24, 2025

After sending a small ETH transaction to cover gas fees, the hacker executed the attack, draining the entire contract.

This comes in the wake of the Bybit hack, in which attackers drained approximately $1.5 billion from the exchange’s hot wallets. With two high-profile hacks happening so close together, serious doubts are being cast on our trust in developers and whether smart contracts are really secure.

As crypto users and investors grapple with the ramifications of these high-profile hacks, one thing is for certain: Security needs to be taken more seriously than ever before.