Injective halts blocks amid suspected $4.9 million exploit
Security & Exploits ·
Injective, a Binance-incubated Layer 1 network geared toward finance applications, paused block production for roughly three hours and 42 minutes around Aug. 31 after a suspected exploit believed to have drained $4.9 million, according to a report.
The chain resumed operations without executing a rollback, meaning no transactions were reversed to undo the incident. Infrastructure provider QuickNode logged a network-wide stall on Injective followed by an emergency patch, pointing to a rapid but reactive response rather than a preemptive fix.
The disruption is tied to a flaw in binary-options settlement logic, which an attacker is said to have exploited to move roughly $4.9 million off the network. The stolen funds were then bridged to Ethereum, a transfer path outlined in reporting on cross-chain bridge activity. As of the latest checks, the funds have not moved further and remain sitting in the destination wallet.
Injective was not alone in experiencing trouble that day. Ontology, an identity-focused public blockchain, also halted its mainnet as a precaution around the same window. Ontology said on Sept. 1 that it had detected malicious activity aimed at its network but stated that user assets were not affected, a distinction from the apparent losses on Injective.
The parallel timing of the two halts drew attention across monitoring accounts tracking the incident, including one post flagging the block-production stoppages as they unfolded. Four distinct sources have now corroborated elements of the Injective exploit, the size of the loss, and the subsequent bridging of funds to Ethereum.
What remains unclear is the precise mechanism attackers used to trigger the settlement bug, whether Injective plans any compensation or mitigation steps following the emergency patch, and whether the $4.9 million on Ethereum will be moved, frozen, or recovered. Ontology's claim that user funds were untouched has not yet been independently verified beyond its own statement.