The Injective Blockchain Was Down for About Four Hours Amid a Possible Hack

• On August 31, the Injective network stopped processing blocks for almost 4 hours.
• The community reported a hack, with the attacker potentially exploiting binary options mechanics to inflate results.
• Losses are estimated at up to $4.9 million.
• The team did not respond to the incident.

On August 31, 2026, the Injective Layer 1 network stopped processing blocks for about four hours amid a possible hack. According to onchain analysts, the attacker exploited how binary options work to trick the protocol and withdraw nearly $5 million.

As shown, the halt occurred at block height 181,027,006. It lasted 3 hours and 42 minutes. 

At the time of writing, the project team had not commented on the situation. At the same time, as analyst Paddy-earthling noted, promotional posts continued to be published on the project’s official page during this period, which drew criticism toward the team. 

Hack Details

The suspected attack mechanism was linked to a bug in how Injective’s binary markets were mapped to insurance funds.

According to researcher Yi, the attacker traded with themselves via different subaccounts and, by repeatedly opening and closing long and short positions, created a situation where the protocol accounted for more funds to be refunded than actually remained in the system.

Under normal conditions, when settling such a market, the resulting shortfall should have led to reduced payouts to users. However, the attacker may have been able to bypass this mechanism.

The issue lay in how the market_id identifier was constructed. Market parameters were concatenated without separators, so different data sets could end up with the same identifier.

This made it possible to link, for example, a market in USDC to an insurance fund in INJ.

When calculating the shortfall, the protocol reportedly failed to account for the fact that these were different assets and compared their numerical values directly. As a result, a small amount of INJ could be mistakenly deemed sufficient to cover a deficit in USDC or another token.

After that, the system did not reduce payouts, and the remaining positions received a full refund. This is how the attacker was able to withdraw more funds than they initially deposited.

In one of the examples cited, about 44,099 USDC was deposited, and 62,667 USDC was withdrawn. The difference was approximately 18,568 USDC.

The exact total damage as of the time of writing is unknown. By various estimates, it ranges from $4.6 million to $4.9 million. 

Notably, this is not the first blockchain halt due to a cybersecurity incident in recent times. Earlier, we reported that the Fogo and Cronos networks went offline. 

Сообщение The Injective Blockchain Was Down for About Four Hours Amid a Possible Hack появились сначала на INCRYPTED.