Injective binary-options settlement exploit (2026-08-31): about $4.8M taken, 1,979.8 ETH of the proceeds held on Ethereum as of Oct 27
- Scam type: Hack
- Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
- Project or site name: Injective (exchange module, binary options markets)
- Incident date: 2026-08-31
- Reported: 2026-10-27
- Last updated: 2026-10-27
On 2026-08-31 an attacker took about $4.8M in USDC (BlockSec's estimate; Metaverse Post and CryptoSlate report about $4.9M) from the binary options markets built into Injective's exchange module. This report lists the attacker's Injective account, the Ethereum address with the same key that bridged the funds out, the two Ethereum wallets that received the swapped ETH, and a wallet that received part of the proceeds on 2026-09-07. What happened: BlockSec traces the loss to two bugs. Binary options market IDs, and the market ID an insurance fund is created for, were hashed from fields joined…
Other addresses in this report: inj10ykxh78wvp8da6q8xfck3tufl0ux8sp8rulp7p, 0x5a18c382ed5bb01814296ee03026dbf5b32a69ea, 0x9137a6b20b083b07b84294d51ebc04a326787a2d, 0xad5cd7f2afd4b5e9e758e8658a9dc43925b9822e