Injective Halts for Nearly Four Hours to Patch Options Vulnerability
Injective's mainnet stopped block production for approximately 3 hours and 42 minutes on August 31, and then resumed through an emergency patch; on-chain research indicates that attackers profited approximately 1,979.8 ETH, equivalent to about $4.88 million, by exploiting the binary options mechanism.
On-chain block height shows the network recovered from 181,027,006 to 181,027,007, with no block rollbacks during the downtime. QuickNode's status page recorded a complete halt in block production on the Injective mainnet that day; as of now, Injective has not released a complete post-incident report, and details regarding the conditions that triggered the pause, patch code, validator coordination process, and recovery decisions have not been disclosed by the project team.
Researchers pointed to the Frontrunner oracle, which has stopped maintenance but still retains registration status, as the attack vector. The data source of this oracle has been empty for a long time, and the attackers subsequently created 299 permissionless binary options markets referencing this oracle, causing the market to enter a no-quote refund mechanism when prices could not be obtained.
The core of the vulnerability is suspected to lie in the refund calculation: when the binary options market could not read prices, the system was supposed to return funds to participants, but after the related logic was exploited, the refund amount was approximately double the expected value. Attackers repeatedly created markets and triggered refunds, cumulatively extracting assets from the insurance fund or protocol liquidity pool; the issues of "insurance fund being exploited" and "actual losses at the protocol layer" still await verification from official ledgers and patch explanations.
The attackers then exchanged the USDC obtained for approximately 1,980 ETH and consolidated it into an Ethereum address that has not initiated any transfers. Public tracking indicates that this address has not moved funds, and the attackers are suspected of evaluating white-hat settlement options; this is a judgment by researchers and does not represent that the assets have been frozen, confirmed for return, or that the project team has reached a settlement.
Reports also state that the funding gap at the protocol layer may have been filled, but there have been no public governance votes, supplementary funding sources, changes in insurance fund balances, or independent audit confirmations. If the gap was filled by the core team, foundation, market makers, or other off-chain channels, the economic losses can be temporarily covered, but governance transparency, oracle management, and risk parameters for permissionless markets still need to be addressed separately.
Mechanically, the attackers connected the ineffective oracle to the refund logic by creating permissionless markets, amplifying limited losses that should have been borne by failed trades into extractable protocol expenditures; the chain halt cut off continued arbitrage and asset outflow but froze normal trading, liquidation, and fund transfers. Short-term funds typically sell INJ to price smart contracts, oracle, and governance uncertainties, with on-chain liquidity providers and derivatives users bearing the risk of the halt; if the funding gap is indeed filled, the patch closes the refund vulnerability and removes the ineffective oracle, the insurance fund and core ecosystem participants bear direct costs, while token holders mainly bear trust depreciation and subsequent governance risks.
Source: Public Information
ABAB AI Insight
Injective's product path has always revolved around on-chain financial infrastructure: decentralized trading, perpetual contracts, prediction and binary markets, oracle integration, and cross-chain asset flow. One of its core commitments is to allow developers and users to quickly create markets, but permissionless creation does not equate to unconditional security inheritance. This attack exploited a defunct but still registered Frontrunner oracle, indicating a disconnect between protocol permission design, oracle lifecycle management, and abnormal price handling: after the data source was deactivated, the reference relationship did not sync to become invalid, yet the system still allowed new markets to continue relying on it for settlement.
In terms of capital flow, the attackers did not directly attack the INJ token or consensus layer, but instead used the 299 markets as repeated withdrawal interfaces. Each time a binary options market referencing a data-less oracle was created and entered the refund process, it would convert the insurance fund or protocol liquidity into withdrawable USDC; the funds were then exchanged for approximately 1,980 ETH and consolidated cross-chain. The cost of the attack is the market creation and transaction execution fees, while the revenue source may be the approximately double payment provided by the refund logic, forming an arbitrage structure of "low marginal cost - replicable - protocol funds bear losses." Halting the mainnet serves to terminate this withdrawal machine, rather than automatically reversing completed cross-chain asset exchanges.
Historically, in 2022, the Mango Markets attacker manipulated low liquidity oracle prices to amplify collateral value and then borrowed assets from the protocol; in 2023, the Euler Finance attack exposed that a single computational link in complex lending logic could cause systemic losses. The commonality between Injective and these two cases is that publicly available on-chain contracts allow attackers to continuously execute trades within the rules, resulting in seemingly "normal" fund flows; the difference lies in that this time the exploited mechanism was the refund process in a no-quote scenario, rather than traditional collateral lending or spot price manipulation. In terms of industry positioning, Injective is expanding from high-performance trading infrastructure to more complex permissionless financial markets, thus shifting its security boundaries from matching throughput to oracle dependency, market creation permissions, and abnormal state machine design.
Essentially, this is a risk spillover in the reconstruction of the industrial chain: permissionless finance hands over market creation, product innovation, and liquidation execution to code and users, but also shifts the review costs traditionally borne by risk control teams, product committees, and suspension mechanisms of exchanges to protocol rules, oracle maintainers, and insurance funds. The mechanism is that the more open the market creation permissions, the more combinations of external data sources, settlement conditions, and refund paths there are; if the defunct oracle is not revoked and the maximum payout for abnormal paths is not capped, attackers can turn marginal states into scalable withdrawal channels. What truly needs to be reconstructed is not whether more markets can be launched, but verifiable governance rules for oracle deactivation, market access, insurance payout limits, suspension permissions, and fund compensation.
ABAB News · Cognitive Laws
Permissionless market creation also creates permissionless attack surfaces
Defunct data sources are not waste, but withdrawal entry points
Halting the chain can stop the bleeding, but cannot replace risk control