Injective Suspends Operations for About 4 Hours Due to Binary Options Vulnerability, $4.9 Million Stolen

Injective suspended operations for about 4 hours due to a vulnerability in its binary options. Attackers exploited a deprecated but still registered oracle to steal approximately $4.9 million. The data source for this oracle has been cleared, and the attackers created 299 markets pointing to this oracle. Unable to obtain prices, they triggered the 'no price refund' mechanism, exploiting a loophole to receive about double the compensation. They then exchanged USDC for approximately 1,980 ETH, which was stored in an Ethereum wallet that had never conducted any transactions. After the attack, Injective's official X account continued to post marketing content without mentioning the chain's suspension. Injective has made its core chain code private, but the attackers discovered the vulnerability through the public SDK, excluding white hats and auditors. The funding gap has been filled at the protocol level, but the repair process lacked governance voting and public disclosure, making verification impossible. The attackers currently have consolidated all funds into one wallet without moving them, seemingly weighing white hat settlement proposals.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.