On August 31, 2026, an attacker took about $4.9 million out of Injective. This was not a broken bridge or a drained lending pool. The exploit abused how Injective named its own trading markets, and the emergency fix that followed touched code the team said was never the problem.
The money has not moved. On-chain analysts traced it as it was bridged to Ethereum through CCTP, swapped for ETH on Uniswap, and pooled into one address holding roughly 1,980 ETH, close to $4.88 million and still sitting there.
The bug lived in how Injective named its markets
Injective built each market identifier by joining five fields, the oracle type, the ticker, the quote denomination, the oracle symbol, and the provider, into a single string with no separators and no length prefixes.
Shift where one field ends and the next begins, and two different markets can resolve to the same identifier. Per the technical breakdown from Metaverse Post, the attacker crafted an INJ-denominated insurance fund whose ID collided with a USDC-denominated binary-options market.
The rest was mechanical. The attacker matched trades against himself across several subaccounts and set the oracles so they would never return a price, leaving the settlement logic to misread which asset was which. One cited cycle turned about 105,000 USDC in deposits into more than 204,000 USDC on the way out. The window ran for roughly 19 hours and touched 299 separate binary-options markets before anyone stopped it.
Injective called it an upgrade
When the blocks stopped, the wording mattered. Production first stretched to 38-minute gaps, then validators intervened, and the chain sat frozen for 3 hours and 42 minutes, from about 16:10 to 19:52 UTC. Injective's foundation described the event as an upgrade rather than a halt, and said consensus, native INJ, and staked assets were never compromised, with only applications built on binary-options markets affected.
That account did not hold up against the chain. As CryptoSlate reported, researcher Earthling Paddy credited Injective for containing the damage but placed the vulnerable logic inside core protocol modules, the native exchange and insurance modules, not the isolated application code the team pointed to. A blockchain that pauses itself and ships an emergency patch has halted.
The softer word has precedent. A shared Cosmos EVM bug stopped six chains in August, and MANTRA put the blame on the module itself rather than its own setup. Injective at least handled the seam well. The network advanced exactly one block across the gap and kept every executed trade, where the Cronos restart had not.
What the patch actually changed
The fix says the most. The release tagged v1.20.3-safeharbor.1 added an insurance-fund denomination check and switched off binary-options settlement across mainnet. Both changes live in core code. You do not patch the protocol layer to repair a contract that one team deployed on top of it.
Identifier bugs like this keep coming back because the shortcut is so easy to take. A memo field once left a Coreum bridge holding 200,000 XRP it could not release, the same class of mistake in different code. INJ traded near $4.80 after the event, down about 1.4 percent on the day, a mild reaction for a chain that stopped for most of an afternoon. Injective has not published a full postmortem, and it has not put a number on total losses or said where any recovery would come from. Until it does, the market is taking the word upgrade on trust, and the bridged funds have not moved.