Injective halts blocks nearly 4 hours after $4.9M exploit
Injective paused block production for nearly four hours on Aug. 31 to deploy an emergency patch after a reported $4.9 million exploit; the foundation reported consensus, INJ and staked assets were not compromised.
Block production on Injective stopped after block 181027005 at 16:09:59 UTC on Aug. 31 and resumed roughly four hours later after validators and infrastructure providers moved to an emergency release, v1.20.3-safeharbor.1.
The release changed core protocol logic to add an insurance-fund denomination check and disabled binary-options settlement on mainnet while the network upgraded. Observers recorded unusually long block times during the interruption, including a single block that took about 37 minutes to finalize.
The Injective Foundation reported that consensus, the native INJ token and staked assets were not compromised. The foundation said the incident affected a limited number of ecosystem applications offering binary-options markets and that it will add stronger invariants, real-time monitoring and other safeguards.
An on-chain researcher known as Earthling Paddy traced the exploit to messages from Injective’s native exchange and insurance protocol modules, indicating the vulnerable logic sat inside protocol-level components used by applications. The researcher estimated roughly $4.9 million was bridged to Ethereum during the incident and reported those funds appeared to remain in an attacker-linked wallet at the time of reporting.
The emergency response had operational consequences. Some validators were temporarily jailed after missing the required upgrade window. Major exchanges temporarily restricted transfers and paused deposits or withdrawals for INJ during the outage.
The foundation has not published a full technical postmortem and has not disclosed a final tally of losses, which party absorbed any shortfall, or whether an ecosystem pool that now appears replenished was restored by the foundation, developers, or another participant.
Injective CEO Eric Chen posted on X: “Injective users aren’t affected and we’ve been helping the team on recovery. Always sad to see exploits happening in the ecosystem but we’re glad that the incident was contained before further harm was done.”
Injective is a layer-1 blockchain that supports an on-chain exchange and other decentralized applications, with INJ as its native token and on-chain mechanisms for staking and insurance funds.
Articles by this author
