$4.9M Injective Hack: Layer-1 Blockchain's 4-Hour Freeze and Bumpy Recovery
Injective, a layer-1 blockchain network, temporarily halted block production for nearly four hours in response to an exploit that researchers estimated drained around $4.9 million. The incident occurred on August 31 and affected a protocol module used by applications rather than solely within application code.
The foundation initially described the incident as an 'upgrade' rather than a halt, claiming that its consensus, native INJ, and staked assets were never compromised. However, researcher Earthling Paddy disputed this characterization, pointing out that the attack used messages from Injective's native exchange and insurance modules.
The emergency response patched the chain's core code by adding an insurance-fund denomination check and disabling binary-options settlement on mainnet. The patching process took longer than expected, resulting in a four-hour interruption in block production. Some validators were temporarily jailed after missing the required upgrade window, while exchanges including Coinbase and Coins.ph temporarily restricted transfers.
The incident has left several questions unanswered, including the total losses, recovery funding, and whether the attacker-linked wallet still holds the bridged ETH. Injective has maintained that its users weren't affected and has been helping the team on recovery.