Layer-1 blockchain halts consensus while validators deploy emergency patch
Injective, a layer-1 blockchain network, paused block production for nearly four hours on Aug. 31 after validators deployed an emergency patch in response to a reported $4.9 million exploit affecting core protocol modules.
Block 181027005 was produced at 16:09:59 UTC, after which block production stopped. The network resumed consensus operations following deployment of emergency release v1.20.3-safeharbor.1. During the incident, one block took 37 minutes to produce, according to on-chain researcher Earthling Paddy.
The attack exploited binary-options settlement and ecosystem applications using binary-options markets. Earthling Paddy identified the vulnerability as stemming from Injective’s native exchange and insurance modules, which are protocol-level components, not solely application code. The emergency patch added an insurance-fund denomination check and disabled binary-options settlement on mainnet.
Roughly $4.9 million was bridged to Ethereum during the exploit and remained in the attacker-linked wallet as of reporting. Some validators were temporarily jailed after missing the required upgrade window.
Injective’s consensus layer, native INJ token, and staked assets were not compromised. However, the foundation’s characterization of the event differed from the operational reality. On Sept. 1, the foundation stated the blockchain was “upgraded, not halted,” and that consensus was never compromised. Block production stopping for four hours and requiring an emergency patch to core modules contradicts this framing.
Eric Chen, Injective CEO, said in a statement: “Injective users aren’t affected and we’ve been helping the team on recovery. Always sad to see exploits happening in the ecosystem but we’re glad that the incident was contained before further harm was done.”
Coinbase and Coins.ph, two exchanges listing INJ, temporarily restricted transfers during the incident. INJ traded at $4.80 as of press time, down 3% over the previous 24 hours.
Injective has not published a full technical postmortem. The foundation did not disclose which party absorbed losses, the total amount ultimately drained, or the final loss allocation among affected parties.
