Injective Integrates Native USDC — While Bug Bounty Dispute Erupts
Injective announced native USDC and CCTP integration from Circle. At the same time, security researcher f4lc0n accused the team of offering $50K instead of $500K for a critical vulnerability that put $500M at risk.
Layer-1 blockchain platform Injective has announced native integration of the USDC stablecoin and Circle's Cross-Chain Transfer Protocol (CCTP). The mainnet rollout will be gradual — USDC is currently live on testnet.
"USDC and CCTP, powered by @circle, are officially coming to Injective. The world's largest regulated stablecoin. Secure crosschain transfers. All natively integrated into the fastest blockchain built for finance. Mainnet loading." — Injective 🥷 (@injective), original post
Why This Matters
The Injective team points to the sheer scale of the stablecoin market to underscore the significance: stablecoin transaction volume reached $33 trillion in 2025, up 72% year-over-year. USDC alone processed $18.3 trillion — more than half of Visa's annual volume and five times that of PayPal. With USDC's market cap sitting at nearly $80 billion, native access to that liquidity pool is a meaningful upgrade for Injective users.
The project frames stablecoins not as a crypto experiment but as established global payment infrastructure.
Integration Architecture
USDC on Injective leverages the MultiVM token standard, offering full compatibility across both Wasm and EVM execution environments. Developers say this eliminates the need for bridges, wrapped tokens, and fragmented liquidity pools.
CCTP, as the native cross-chain infrastructure of the USDC issuer, gives users and developers three core capabilities:
- seamless movement of the stablecoin across supported networks;
- transfers with near-instant finality;
- ability to build apps for cross-chain settlement, trading, and native liquidity management.
Bug Hunter Accuses Injective of Underpaying Critical Vulnerability Report
The integration announcement arrived alongside a public dispute over a bug bounty payout. Security researcher f4lc0n on Immunefi claims Injective offered him just $50,000 for a critical vulnerability — a fraction of the $500,000 maximum listed on the project's bounty page.
"I Saved Injective's $500M. They Pay Me $50K." — f4lc0n (@al_f4lc0n), original post
According to f4lc0n, the flaw resided in the subaccount verification system and would have allowed an attacker to place market orders on behalf of other users without permission. The exploit path involved creating a new token, setting up a spot market against USDT, purchasing assets from other traders' accounts, and withdrawing funds to Ethereum — all without any authorization.
The researcher published a detailed report on GitHub and argues the vulnerability put the entire capital stored on the blockchain at risk — $500 million at the time of discovery. According to Arkham data, the figure now stands at just over $285 million, with roughly $269 million attributable to the native INJ token.
F4lc0n states the Injective team went silent for three months after his initial disclosure, then conducted a governance vote and upgraded the network to patch the issue. When they finally responded, the offer came in at 10 times below the maximum bounty. "To be clear, they haven't paid the $50,000 either," he added.
Injective's Immunefi page lists $500,000 as the top payout for a critical-severity finding. F4lc0n maintains his discovery falls squarely in that category.
Frequently Asked Questions
What is CCTP and why does Injective need it?
CCTP (Cross-Chain Transfer Protocol) is Circle's native cross-chain infrastructure for USDC transfers. Its integration into Injective enables bridgeless, near-instant USDC movement across supported networks without wrapped tokens or liquidity fragmentation.
How large is USDC's market cap?
At the time of the announcement, USDC's market capitalization stood at nearly $80 billion. In 2025, the stablecoin processed $18.3 trillion in transactions — more than half of Visa's annual volume.
What was the Injective subaccount vulnerability?
Researcher f4lc0n identified a flaw in Injective's subaccount verification system that would have allowed an attacker to place market orders on behalf of other users without permission. The exploit could also drain funds to Ethereum, and f4lc0n estimated $500 million in on-chain assets were at risk.
Why does f4lc0n believe he deserves $500,000?
Injective's Immunefi bounty page lists $500,000 as the maximum payout for a critical-severity vulnerability. F4lc0n argues his finding qualifies for that tier, but the team offered $50,000 — ten times less — and had not paid even that amount at the time of his public disclosure.
When will native USDC launch on Injective mainnet?
The rollout is planned in stages. As of March 17, 2026, USDC is available on Injective's testnet, with a mainnet launch described as imminent but without a confirmed date.
Read also
Stablecoin Transfer Volume Hits $10.5 Trillion in January — Highest Since April 2022
January stablecoin transaction volume surpassed $10.5 trillion, marking the highest monthly figure since April 2022. USDC led transfers while USDT maintained market cap dominance.
Top 10 Dollar Stablecoins in 2026: From Dominant Players to Exit Candidates
The stablecoin market has surpassed $311 billion in total capitalization. Here's a breakdown of the ten largest USD-pegged stablecoins — from undisputed leaders Tether and Circle to ambitious newcomers.
Drift Protocol Hack Victims File Class Action Lawsuit Against Circle Over $230M in USDC
Over 100 victims of the Drift Protocol exploit have filed a class action lawsuit against Circle in Massachusetts court, accusing the USDC issuer of negligence and enabling hackers.
Drift Protocol on Solana Hacked for $280M in Sophisticated Durable Nonce Attack
Solana-based DeFi platform Drift Protocol lost at least $280 million in a hack on April 1. The DRIFT token dropped 37% while Circle faces criticism for failing to freeze stolen USDC.
TRON Energy Rental: How to Cut USDT Transfer Fees by Up to 60%
USDT issuance on TRON surpassed $85 billion in February 2026, but transfer fees remain steep at $1.83–$3.83 per transaction. Energy rental services like TronZap offer a way to cut costs by 50–60%.
How ERC-8004 and x402 Standards Are Turning AI Agents Into Market Participants
Blockchain standards ERC-8004 and x402 are building the infrastructure for autonomous machine payments, challenging Big Tech's closed ecosystems and the attention economy model.