Infini Hacker Offered 20% of Stolen Funds for Their Return, Faces Legal Threat if Ignored

Hong Kong-based neobank Infini is attempting to recover $49.5 million in stolen funds by offering the hacker 20% of the amount if they return the assets within 48 hours. If the deadline is ignored, Infini has warned of legal action and ongoing investigations in coordination with authorities.

The payments card issuer, which provides interest on dollar stablecoin deposits, disclosed that it has gathered “critical IP and device information” on the attacker. The exploit nearly wiped out Infini’s wallets just days after the platform celebrated surpassing $50 million in total value locked (TVL), according to blockchain security firm PeckShield.

This incident follows the staggering $1.5 billion hack of crypto exchange Bybit, marking another major security breach in the industry within the same week.

In an on-chain message, Infini directly addressed the hacker:
“We are closely tracking the address involved and are ready to act swiftly to freeze any stolen funds. However, to resolve this matter amicably, we are offering you 20% of the stolen assets should you choose to return them voluntarily.”

The company made it clear that if no action is taken, it will escalate the situation and continue pursuing the perpetrator alongside law enforcement.

According to cybersecurity firm Cyvers, the attack was carried out by a developer who previously worked on Infini’s smart contract and retained unauthorized admin privileges. After months of dormancy, they exploited this backdoor and transferred the funds to a wallet linked to the crypto mixer Tornado Cash.

In response, Infini’s founder, Christian Li, has accepted full responsibility for the security lapse and vowed to reimburse affected users from his personal funds.