Cabinet
Back to Technology Insights
2026.08.31

Injective loses roughly $4.9M through a binary-options "no price, refund" path — 3h42m without blocks, and a gap between the official account and third-party analysis

Injective loses roughly $4.9M through a binary-options "no price, refund" path — 3h42m without blocks, and a gap between the official account and third-party analysis

What the chain records

The verifiable facts are these. Block 181,027,006 is timestamped 2026-08-31 16:10:02 UTC; the next block, 181,027,007, is timestamped 19:52:14 UTC the same day. The gap is 3h42m12s, and height advanced by exactly one across the seam — nothing was rolled back, and executed trades survived. In the run-up, block intervals had stretched to roughly 37 to 38 minutes, meaning production was already close to failing.

On 1 September, Injective stated on X that contributors had completed an accelerated upgrade across all validators and ecosystem infrastructure, that it took longer than planned, and that the blockchain and INJ remained secure throughout — consensus, native assets and staked assets were never compromised. It characterised the attack as affecting a limited number of ecosystem applications operating binary-options markets, and said reports describing an exploit or a halt of the blockchain were inaccurate. Because the upgrade was accelerated, some validators were temporarily jailed after missing the required window, and exchanges including Coinbase and Coins.ph restricted transfers.

Independent researchers who reconstructed the event from chain data — Paddy-earthling, who discloses holding INJ, and Rarma — disputed parts of that framing on grounds of precision. The former notes that the attack used messages from Injective's native exchange and insurance modules, and that the emergency release v1.20.3-safeharbor.1 added an insurance-fund denomination check and disabled binary-options settlement on mainnet. On that reading the vulnerable logic sat in a protocol module used by applications, not in application code alone. Injective has published no full technical post-mortem, so the mechanism described below rests on third-party analysis.

How the attack was set up

Per that analysis, the attacker used MsgInstantBinaryOptionsMarketLaunch to create binary-options markets with themselves as admin, attaching a self-operated oracle. The oracle's symbol was NO_PRICE_FOR_REFUND_P44_USDC. Expiry and settlement timestamps sat roughly ten seconds apart, fees were set at 1e-6, and notional was uncapped. When no valid price is available at settlement, the protocol falls back to a refund path. Every parameter pointed the market toward settling immediately into that path and nowhere else. The attacker held simultaneous long and short positions across their own sub-accounts and extracted more collateral than was deposited. 299 short-lived markets were created.

Losses are estimated at roughly $4.9 million (about ¥764 million at 1 USD = 156 JPY; rate from Trading Economics, 2026-09-03), reported to have been bridged to Ethereum. The final attempt failed not because a control caught it but because the attack's own load slowed block production to roughly 38-minute intervals and the settlement timestamp expired.

The generalisable point is the combination of permissionless market creation with an oracle-failure fallback. Each feature is defensible alone. But when "anyone can create a market", "the creator names the price source" and "no price means refund" all hold at once, an attacker can manufacture the failure condition that suits them. Refund paths are written as exception handling, so they attract less rigorous invariant testing than the happy path — a structural weakness that compounds the design one. Compared with the Cronos/Tectonic price-manipulation incident earlier in August, this is the inverse: not manipulating a price, but manufacturing the absence of one. The oracle's integrity was never the target; its failure behaviour was.

Disclosure was its own issue. During the 3h42m without blocks, Injective's official account posted twice, both marketing, with no mention of the disruption, according to several observers. That is not a technical failure, but it means integrators cannot assume that watching official channels is sufficient to detect an incident — a contrast with Cronos and others who narrated their outages publicly.

Separately, Injective has taken the injective-core and injective-chain repositories private, so the implementation can no longer be read externally. The stated logic is that it makes bugs harder to find. Third-party analysts point out that this attack was reachable through message types and parameter combinations without reading source. Where obfuscation is adopted without establishing which attack classes it actually deters, what remains is the cost to external implementers who can no longer verify behaviour against the spec.

Pitfalls to watch

"No rollback" does not mean low impact. Height advancing by one shows existing transactions were preserved, but 3h42m without settlement is a serious event for exchanges, bridges and liquidation bots regardless.

The official phrasing — an upgrade, not a halt — is difficult to act on operationally. Blocks did not advance, validators were jailed and exchanges suspended transfers. Monitoring should be anchored to block intervals and finality that you observe yourself, not to the wording of an announcement.

The emergency response was itself a breaking change. v1.20.3-safeharbor.1 is reported to have disabled binary-options settlement on mainnet. That is reasonable containment, but applications and bots built on those markets stop working for reasons unrelated to the attack. Emergency releases often remove functionality rather than restore it; check the release diff for your own dependencies.

Validator jailing has a tail. Because accelerated upgrades compress the update window, operations that are not automated are structurally disadvantaged, and displayed network stake dips until affected validators are restored.

[Technical Insights & Actions]

  1. Exception handling is the cheapest way in. The branch that runs "when no valid price arrives" typically carries thinner invariant testing than the happy path, and the attacker can often construct the failure condition themselves. The same applies to your own contracts: oracle absence, timeouts and failed liquidations deserve the same rigour as normal operation. [Contract developers] Before your next audit engagement, enumerate every branch triggered by missing external data and add an explicit review item asking whether an attacker can deliberately create that condition.
  2. In protocols with permissionless market or pool creation, the creator's freedom to set parameters — price source, expiry, fees, caps — is itself a privilege. "Anyone can create" and "anything can be specified" are separable design decisions. [Product / contract developers] This quarter, inventory your creation endpoints for price-source allowlisting and notional caps, and raise a spec change where neither exists.
  3. When an official statement and third-party onchain analysis diverge, integrators should rely on what they can observe. A statement defines scope of responsibility; it is not an operational signal. [Integrators / operations] This week, stand up independent alerting on block interval and finality lag for the chains you depend on, so halt detection does not rely on an official status page.

[Sources]

This article is a technical commentary based on publicly available information and is not investment advice.

Previous ArticleLedger Is Dropping `signEIP712HashedMessage` — All of LedgerJS Goes Deprecated and DMK Migration Becomes MandatoryNext Article Cronos Halts and Restarts Its Chain From a Pre-Exploit State After the Tectonic Attack — and the $6M That Could Not Be Rolled Back