Worked example · 2025-02

Infini neobank treasury drain — Ethereum / multi-chain — 2025-02-24

Loss: approximately $49.5M extracted from Infini's USDC treasury on or around February 24, 2025. Infini is a USD-stablecoin-focused neobank product offering on/off-ramp and stablecoin custody services to retail and prosumer users; the affected balance was the operator-controlled USDC treasury that backed the platform's user-deposit liabilities. The extraction was a single coordinated drain to an attacker-controlled address that the operator subsequently demonstrated, via court-ordered forensics, was pre-funded and prepared for receipt of the USDC outflow.
Recovery: substantial recovery via court-ordered freeze. Following Hong Kong police investigation and arrest in March 2025, the on-chain destination addresses associated with the attacker were subject to a court-ordered asset freeze that immobilised a meaningful share of the extracted balance on cooperating exchanges and stablecoin issuers' authority surfaces. USDC's centralised-issuer authority (Circle's address-blocking primitive) was the operationally decisive recovery mechanism: USDC balances at attacker-controlled addresses could be frozen at the issuer level upon law-enforcement request, preventing the attacker from converting the stolen USDC into other assets via DEX or bridging routes. Per the public reporting, the combined court-ordered freeze + USDC-issuer freeze recovered a substantial fraction of the extracted balance; residual recovery remains contingent on the prosecution outcome.
OAK Techniques observed: OAK-T11.002 in the broad construction (admin-key compromise of a privileged custody surface — see Discussion for the taxonomy-mapping note), with OAK-T9.004 (access-control misconfiguration) as the contributory on-chain class — the operator-controlled USDC-transfer authority that the compromised key held was a real authority surface; the contract-state perspective was that a legitimate role-holder authorised a legitimate transfer. The Infini case is the canonical 2025 worked example for the former-developer credential persistence sub-pattern: a development-phase credential with retained transfer authority over the production USDC treasury, never rotated after the developer's separation from the project, used by that developer to drain the treasury to a pre-funded receiving address.
Attribution: confirmed by Hong Kong law enforcement. Hong Kong police arrested the operator (a former Infini developer) in March 2025; the criminal proceedings explicitly identified the suspect as a former member of Infini's development team and characterised the entry vector as misuse of retained credentials with USDC-treasury transfer authority. This is the rare 2025 worked example where the on-chain pseudonymous-attacker pattern is closed by an off-chain criminal-prosecution attribution — the case is confirmed rather than pseudonymous.
OAK-Gnn: ungrouped — single-actor insider; not OAK-G01 / DPRK-attributed; not part of any documented organised-crime cohort. The attribution is to a named individual via Hong Kong law-enforcement action rather than to a Group-level threat actor.
Key teaching point: separation of a developer from the project is not, by itself, separation of the developer's credentials from the production treasury. The Infini case is the strongest 2025 evidence that key-rotation hygiene at developer-departure events is a load-bearing security control, not a procedural courtesy. A development-phase credential that was issued for legitimate engineering purposes, that retained USDC-transfer authority over the production treasury, and that was not rotated when the developer left the project, became the entry vector for a $49.5M drain executed months later. Defenders running stablecoin-treasury custody should treat (a) credential inventory at every developer-departure event, (b) explicit rotation of any production-authority credentials the departing developer held, and (c) cryptographic enforcement of the rotation (rather than relying on the departing developer's cooperation) as first-class security-engineering requirements.

Summary

Infini is a USD-stablecoin-focused neobank product launched in 2024, offering retail and prosumer users on/off-ramp services, debit-card spending against stablecoin balances, and yield products built around the USDC ecosystem. The platform's user-deposit liabilities were backed by an operator-controlled USDC treasury — i.e., a smart-contract or operator-controlled-address surface holding the aggregate USDC balance that corresponded to the platform's user-balance accounting.

On or around February 24, 2025, the operator-controlled USDC-transfer authority over the Infini treasury was used to direct approximately $49.5M in USDC to an attacker-controlled receiving address. The on-chain transaction was authorised-looking: it was issued by a legitimate authorised key, called a legitimate transfer function, and produced a state transition the system was designed to permit. The receiving address was, per the court-ordered forensics that followed, pre-funded with operational gas balances and prepared for receipt of the inflow — the timing and pre-funding pattern indicated coordinated planning rather than opportunistic compromise.

Within hours of detection, Infini paused user-side withdrawal operations and engaged Hong Kong law enforcement. The investigation rapidly identified the entry vector as misuse of retained credentials by a former Infini developer who had separated from the project at an earlier date but whose development-phase credentials had retained transfer authority over the production USDC treasury. In March 2025, Hong Kong police arrested the suspect; the criminal proceedings publicly named the individual and confirmed the former-developer-credential-misuse framing.

The recovery proceeded via two complementary mechanisms. First, USDC's centralised-issuer freeze authority — Circle's ability to administratively freeze USDC balances at flagged addresses in response to law-enforcement requests — was invoked against the attacker-controlled receiving address and its downstream hops. This prevented the attacker from converting the stolen USDC into other assets via DEX or bridging routes. Second, court-ordered freezes against cooperating exchange accounts associated with the attacker immobilised additional portions of the balance that had been routed off-chain. Combined, the two mechanisms recovered a substantial fraction of the extracted balance; residual recovery depends on the criminal-proceeding outcome.

For OAK's purposes the structurally important features are (a) the former-developer credential-persistence entry vector, (b) the confirmed-by-prosecution attribution status, and (c) the USDC-issuer-freeze + court-ordered-freeze recovery primitive that is uniquely available for stablecoin-denominated thefts of this scale.

Timeline (UTC)

When	Event	OAK ref
Pre-event (2024)	Infini launches its neobank product; development-phase credentials with USDC-treasury transfer authority issued during build-out	T11.002 surface (latent)
Pre-event	Developer separates from Infini at an earlier date; credentials with retained production-treasury authority not rotated at separation	(latent custody surface)
Pre-event (early 2025)	Former developer pre-funds a receiving address with operational gas balances; prepares the address for inflow	(attacker preparation)
2025-02-24	Treasury-transfer authority used to direct ~$49.5M USDC from Infini operator-controlled treasury to the attacker-controlled receiving address	T11.002 broad / T9.004 contributory extraction
2025-02-24	Infini detects the anomalous outflow; pauses user-side withdrawal operations; engages Hong Kong law enforcement	(operator response)
2025-02-24 → days following	Circle (USDC issuer) is notified; USDC freeze authority invoked against attacker-controlled addresses; downstream USDC hops also frozen as identified	L1-equivalent recovery primitive (USDC issuer freeze)
2025-02 → 2025-03	Hong Kong police investigation identifies former-developer suspect; on-chain forensics + off-chain credential-trail analysis confirm the entry vector	(law-enforcement attribution)
2025-03	Hong Kong police arrest the named suspect; criminal proceedings initiated; public statement identifies suspect as former Infini developer	Confirmed attribution (law-enforcement-named)
2025-03 onward	Court-ordered freezes against cooperating exchange accounts immobilise additional portions of the balance that had been routed off-chain	Recovery via court order
2025-03 onward	Infini publishes post-incident communications; corrected credential-management policy implemented; user-balance restoration coordinated	(transparency, recovery)

What defenders observed

The transaction was authorised-looking on-chain. The treasury drain was not a smart-contract bug in the canonical T9.005 sense — the USDC-transfer function was a legitimate operation called by a legitimate authorised key. The attack was a credential-misuse compromise, not a contract compromise. Defenders attempting to triage with a smart-contract-vulnerability lens would not have flagged this as anomalous because the contract was operating as designed; the relevant defender control is credential-management hygiene, not contract-side detection logic. This is structurally similar to the ZKsync case at examples/2025-04-zksync-airdrop.md, with the distinguishing features being (a) the entry-vector specifics — former-developer credential persistence rather than a key-storage compromise — and (b) the recovery-mechanism specifics — issuer-freeze + court-order rather than bounty negotiation.
The pre-funding signal was a meaningful forensic indicator. The receiving address had been pre-funded with operational gas balances before the drain, indicating coordinated planning. This is a recurring forensic signal across insider-threat cases: pre-positioning an attacker-controlled receiving address signals deliberation and pre-meditation rather than opportunistic compromise, and it strengthens the case for criminal prosecution under jurisdictions where deliberation is an aggravating factor. Defender investigators should treat receiving-address pre-funding patterns as a first-class forensic signal in custody-compromise cases.
USDC's centralised-issuer freeze is a recovery primitive that has no decentralised-asset analogue at scale. Circle's ability to administratively freeze USDC balances at flagged addresses, in response to law-enforcement requests, is the operationally decisive recovery mechanism for stablecoin-denominated thefts of this scale. It depends on (a) the centralised-issuer architecture of USDC (Circle holds the freeze authority by design), (b) Circle's willingness to invoke the authority in response to verifiable law-enforcement requests, and (c) the speed of identification of attacker-controlled addresses before the attacker can convert USDC to assets outside the issuer's authority. None of these conditions are unconditional — Circle's invocation is discretionary, the verification process takes time, and aggressive attacker-side conversion can outrun the freeze — but in the Infini case the conditions held. Defenders modelling stablecoin-treasury risk should treat issuer-freeze as a real but conditional recovery primitive; the existence of the primitive does not substitute for primary custody hygiene.
The court-ordered exchange freeze was a complementary mechanism. Beyond the on-chain USDC-issuer freeze, court-ordered freezes against cooperating exchange accounts immobilised portions of the balance that had been routed off-chain. This second mechanism depended on jurisdictional cooperation between Hong Kong courts and the cooperating exchanges' compliance teams. The Infini case is a positive 2025 reference for the cross-jurisdictional cooperation surface around stablecoin-denominated thefts; the recovery would have been substantially smaller without it.
Confirmed-by-prosecution attribution is the rare-but-achievable outcome for insider-credential cases. The 2024–2025 corpus is heavily pseudonymous at the attribution layer; confirmed attribution typically arrives via FBI / OFAC / IC3 publication for OAK-G01 cases. Insider-credential cases are a separate path to confirmed attribution: the credential trail is necessarily traceable through the project's internal records, the on-chain forensic reconstruction is typically clean, and the suspect cohort is small and identifiable. The Infini case is the strongest 2025 evidence that this path is operationally productive when the entry vector is internal-credential misuse — the attribution rate for this entry-vector class is much higher than for external pseudonymous DeFi exploits.

What this example tells contributors writing future Technique pages

The former-developer credential-persistence sub-pattern deserves explicit defender-handbook recognition. The Infini case is the canonical 2025 worked example for this sub-pattern within the broader admin-key-compromise category. Contributors writing OAK Mitigation pages should call out: (a) credential inventory at every developer-departure event must be exhaustive, including any production-authority credentials the developer held; (b) rotation of those credentials must be cryptographic and enforced rather than procedural and trust-based; (c) post-rotation verification that the departed developer no longer holds residual authority must be explicit. The Ankr 2022 case (former-employee credential reuse leading to malicious aBNBc upgrade) is the prior worked-example sibling for this sub-pattern; Infini is the 2025 evidence that the pattern continues to fire on substantial-balance custody surfaces.
OAK v0.1's T11.002 mapping is imperfect for admin-key compromise of a non-wallet privileged custody surface; the user-supplied mapping is honoured here, with the same taxonomy-gap note as ZKsync. As with the ZKsync case at examples/2025-04-zksync-airdrop.md, the published T11.002 page is scoped to wallet-software distribution compromise. The Infini incident is admin-key compromise of an operator-side privileged custody surface — structurally closer to a T11.x admin-key-compromise sub-Technique that does not yet exist in v0.1 than to either T11.001 or T11.002. Contributors writing the OAK v0.x update should consider promoting "admin-key compromise of a protocol-side / operator-side privileged custody surface" to its own T11 sub-Technique, with explicit sub-sub-Techniques for (i) former-employee / former-developer credential persistence (Infini, Ankr 2022, Stake.com candidate vectors), (ii) prolonged-exposure key drift (ZKsync), and (iii) social-engineered current-employee compromise (Stake.com, Atomic Wallet).
T9.004 is the right contributory mapping for the on-chain manifestation. As with ZKsync, the USDC-transfer function existed and was functioning correctly; the access-control issue was that the role-holder's authority extended beyond the organisationally-defensible window — i.e., the credential continued to hold transfer authority over the production treasury after the developer's separation from the project. The T9.004 framing here is "authority-persistence misconfiguration" — the contract permitted the action because the credential still held authority; the defender control is to ensure credentials no longer hold production authority once the operational need has passed.
Issuer-freeze and court-order recovery primitives deserve their own Mitigation-page section. The Infini case is the strongest 2025 evidence that stablecoin-issuer-freeze authority (USDC's Circle-controlled freeze, USDT's Tether-controlled equivalent) is an operationally decisive recovery primitive for stablecoin-denominated thefts. Contributors writing OAK Mitigation pages should preserve this primitive explicitly: it is conditional on (a) issuer cooperation, (b) speed of attacker-address identification, and (c) jurisdictional cooperation for downstream off-chain freezes, but when the conditions hold, the primitive recovers a substantial fraction of stablecoin balances. The primitive has no decentralised-asset analogue at scale; defenders running stablecoin-treasury custody should account for it explicitly in their threat models.
confirmed is the correct attribution status, with the Hong Kong law-enforcement action as the decisive evidence. The Infini case meets OAK's confirmed attribution standard via law-enforcement-named-and-arrested attribution, even though the attribution surface (Hong Kong police) is not the FBI / OFAC surface that produces most OAK-G01 confirmed attributions. Contributors writing the OAK attribution-grading documentation should preserve the multi-jurisdictional surface for confirmed attribution: FBI / IC3 / OFAC / Treasury are not the only authoritative law-enforcement surfaces, and non-US arrests-with-public-naming should clear the confirmed bar.

Public references

[infinipostmortem2025] — Infini's official post-incident communication describing the credential-misuse entry vector, the law-enforcement coordination, and the recovery via issuer-freeze and court order.
[hkpoliceinfini2025] — Hong Kong Police Force public statement on the arrest of the former Infini developer, used as the primary law-enforcement-attribution citation.
[peckshieldinfini2025] — PeckShield on-chain analytics for the extraction transaction and the receiving-address pre-funding pattern, used as the cumulative-loss reference.
[slowmistinfini2025] — SlowMist incident analysis covering the former-developer-credential framing and the issuer-freeze recovery.
[chainalysis2025rug] for category-level context on 2025 stablecoin-incident loss totals (used as the broad-context citation).

Discussion

Infini is OAK's canonical 2025 case for the former-developer credential-persistence entry vector, and one of the rare 2025 worked examples that closes pseudonymous on-chain forensics with a confirmed-by-prosecution attribution. The 2024–2025 corpus is heavily weighted toward pseudonymous attribution; Infini is the case that establishes the insider-credential path as a recurring confirmed-attribution surface, complementing the OAK-G01 / FBI-publication path that drives most other confirmed attributions in the corpus.

The technical teaching point is that key rotation at developer-departure events is a load-bearing security control. The Infini compromise was a textbook failure of this control: a development-phase credential issued for legitimate engineering purposes, retaining USDC-transfer authority over the production treasury, never rotated when the developer left the project. The interval between developer-departure and exploitation gave the former developer time to pre-position the receiving address and plan the drain timing. Defenders running stablecoin-treasury custody — and any custody surface where development-phase credentials might have been issued with production authority — should treat credential inventory at every personnel-departure event as an explicit operational requirement, with cryptographic rotation enforcement rather than procedural trust.

The recovery primitive — combined issuer-freeze and court-ordered exchange freeze — is the second-order observation. USDC's Circle-controlled freeze authority is the operationally decisive mechanism for stablecoin-denominated thefts of this scale; the Infini case is the strongest 2025 evidence that the primitive can be invoked quickly enough to recover a substantial fraction of a $49.5M extraction. The primitive has structural analogues in the centralised stablecoin space (USDT's Tether-controlled equivalent, BUSD historically, regulated-stablecoin issuance structures more generally); it has no analogue at scale for decentralised assets (ETH, BTC, native L1 tokens). Defenders running custody for centralised-stablecoin balances should treat issuer-freeze authority as a real but conditional recovery primitive; defenders running custody for decentralised assets should not expect comparable post-incident recovery surfaces.

The Infini case pairs directly with the ZKsync case at examples/2025-04-zksync-airdrop.md as the 2025 worked-example pair for admin-key compromise of a privileged contract / custody surface. ZKsync is the pseudonymous case with bounty-mediated recovery; Infini is the confirmed-by-prosecution case with issuer-freeze + court-ordered recovery. Together they bracket the recovery-outcome range for this attack class: at one end, a pseudonymous attacker who accepts a bounty; at the other end, an identifiable insider whose recovery requires criminal prosecution and centralised-issuer cooperation. Both cases expose the same OAK v0.1 taxonomy gap — admin-key compromise of a protocol-side / operator-side privileged custody surface being unmapped at the Technique level — and together they form the strongest 2025 case for promoting this entry vector to its own T11.x Technique in a future v0.x update.

For OAK's broader credibility, including Infini in v0.1 closes three gaps: it adds a confirmed-by-prosecution 2025 worked example to a corpus weighted toward pseudonymous attribution, it documents the stablecoin-issuer-freeze recovery primitive as a first-class operational consideration for stablecoin-treasury custody, and it pairs with ZKsync to bracket the recovery-outcome range for the admin-key-compromise entry-vector class.