White Hat Hacker Discovers Vulnerability in Injective Endangering $500 Million in Assets, Receives Only $50,000 Reward and Payment Still Pending

ZkProver · 2026-03-16T03:16:10+00:00

White hat hacker f4lc0n disclosed on the X platform that he discovered a critical vulnerability in the Injective protocol that could potentially lead to the extraction of over $500 million in assets, but the project team only offered a $50,000 bounty, far below the $500,000 cap. He has disputed the bounty proposal and plans to use 10% of future vulnerability bounties for continued recovery efforts.

ZkProver

2026-03-16 03:16:10

Abstract generation in progress

ChainCatcher news: White hat hacker f4lc0n posted on X that he discovered a “serious” level vulnerability in Injective Protocol, which could lead to the direct withdrawal of over $500 million in on-chain assets. However, the project team only offered him a $50,000 reward, far below his planned maximum of $500,000 for this level of vulnerability.

f4lc0n stated that this vulnerability allows any user to empty any account on the chain without special permissions. After submitting the report through Immunefi, the Injective team initiated a mainnet upgrade vote to fix the vulnerability the next day, but then went “dark” for the following three months.

Currently, f4lc0n has raised concerns about the reward amount and claims that the $50,000 reward has not yet been paid. He announced that he will allocate 10% of future bug bounty earnings to continue publicizing this matter until Injective pays according to the standard.

INJ3.84%

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.

2 Likes