Injective Contains Ecosystem Exploit as Blockchain Remains Fully Operational

Injective Protocol has confirmed that an exploit affected a limited number of ecosystem applications running binary options markets, prompting an accelerated network upgrade that has since been completed. The team said the core blockchain, consensus mechanism, and native assets were not compromised at any point.

What Happened

The incident centred on Injective's binary options module, a permissionless system that allows developers to build and settle prediction-style markets on-chain. According to independent on-chain analysis, the attack involved a flaw in how the protocol generates market identifiers. The protocol concatenates several parameters to produce a market_id, and this hashing scheme allowed an attacker to create an $INJ-denominated insurance fund that collided with the identifier of a USDC-denominated binary options market. When the refund procedure was triggered, the system may have treated minimal balances as sufficient to cover significantly larger liabilities, suggesting a deeper flaw in the settlement logic.

Injective went dark for roughly three hours and 42 minutes on August 31. Funds from the suspected exploit were moved from Injective to Ethereum via Circle CCTP, with a portion subsequently swapped through Uniswap and consolidated into ETH. On-chain data shows approximately 1,979.8 ETH, valued at roughly $4.88 million, collected in a single address. Block production stopped at block 181,027,006 around 16:10 UTC and resumed with block 181,027,007 at approximately 19:52 UTC, with no rollback of confirmed transactions occurring during the recovery.

Network Status and Response

Injective completed an accelerated network upgrade following the incident, with the team stating it did not compromise the blockchain, consensus mechanism, native $INJ assets, or user and staked funds. Some validators were temporarily jailed, and several exchanges paused deposits and withdrawals while completing node upgrades.

As of its September 1 statement, the Injective network is fully operational, temporary restrictions on certain exchanges are being lifted as node updates finish, and staked assets remain secure. Injective said it is introducing additional technical controls, including enhanced invariants, real-time monitoring systems, and further safeguards intended to detect unusual activity earlier.

The incident renewed scrutiny of Injective's decision to remove its core chain repositories from GitHub. Critics contend the exploit demonstrates the limits of security through obscurity, noting the attacker relied solely on public SDK documentation and legacy compiled binaries to reverse-engineer the vulnerability, while independent auditors and whitehat researchers were denied the source-level access needed to identify the flaw proactively.

Sources:
Injective Confirms Secure Network Upgrade After App Exploit – The Crypto Times
Injective Exploited For $4.9M Via Market ID Collision – Metaverse Post
Injective Network Hit by $4.9M Exploit and Outage – CryptoDnes