Weakness and ignorance are not barriers to survival. Arrogance is. @injective got hacked. I joined forces with @S7iter_ to analyze the attack. Injective binary options are zero-sum by design. Buy Q at price P and the long locks P * Q, the short locks (1 - P) * Q. Total collateral should stay equal to Q. This exploit breaks that invariant, then stops the normal refund haircut from putting it back. The break is how a binary options market is bound to its insurance fund. market_id was hashed from fields concatenated with no separator and no length prefix: oracleType, ticker, quoteDenom, oracleSymbol, oracleProvider. Same byte string, two different parses. Example: insurance fund uses ticker = X, quote = inj, oracle_base = USDC_DENOM + SYMBOL. Binary options market uses ticker = Xinj, quote = USDC_DENOM, oracle_symbol = SYMBOL. Different objects, same market_id. An INJ insurance fund can sit on a USDC-denominated binary options market. Attacker traded against themselves across subaccounts. 1) Open long + short at 0.10. Long locks 0.1Q, short locks 0.9Q. 2) Close the long at 0.90 with margin = 0. Gets ~0.9Q back (original margin + realized PnL). 3) Old short still has 0.9Q margin on the books. Open a new long at 0.90 with another 0.9Q. 4) Deposited 1.9Q total. Old long already took ~0.9Q out. Remaining positions still show 1.8Q refundable margin. 5) Market settles with no oracle price and hits the -1 refund path. Missing 0.8Q should haircut the leftover positions. Instead settlement tries to cover the hole from the attached insurance fund. 6) Fund is INJ. Deficit is USDC. Code treats the raw integer from the INJ fund as coverage for the USDC shortfall. Dust INJ is “enough”, haircut is skipped, remaining positions refund in full. 7) Withdraw the inflated subaccount balance. One sampled USDC cycle: 44,099.025531 in, 62,666.979111 out. Extra 18,567.953580 is exactly the 0.8Q gap. Same loop on short-lived markets quoted in USDC, Peggy USDT, Noble USDC, and ATOM. Create an INJ insurance fund that collides on market_id with a quote-denominated binary options market → 0.10 to 0.90 self-trades to manufacture a refund deficit → no-price settlement → INJ atoms cover a USDC/USDT/ATOM deficit by raw amount → withdraw. github.com/InjectiveFoundati… hi @al_f4lc0n 👀