Injective Blockchain Hit by $4.9M Exploit, Halt Block Production for Hours
Injective's layer-1 blockchain was hit by an exploit that compromised native modules of the protocol, causing the network to halt block production for nearly four hours. The incident led to the transfer of approximately $4.9 million to Ethereum during the attack and left the funds in a wallet linked to the attacker.
The Injective foundation characterized the event as an 'accelerated upgrade' rather than a halt, stating that network consensus, native token INJ, and staked assets were never at risk.
However, on-chain researcher Earthling Paddy challenged this characterization, indicating that the attack used messages originating from the chain's own native exchange and insurance modules. The emergency patch v1.20.3-safeharbor.1 modified the protocol's core code by incorporating a denomination check in the insurance fund and disabling binary options liquidation on mainnet.
Researchers estimate that $4.9 million were transferred to Ethereum during the exploit, with those funds remaining in the wallet linked to the attacker and showing no activity so far. Injective did not disclose the total amount stolen or clarify which party absorbed the losses.