The Infini hack in February 2025 was likely enabled by a former developer who retained admin privileges, allowing the exploit

Quotes that support claims

Cyvers reported that the attacker '0xc49b5' had initially worked on Infini’s contract but never relinquished full control. This oversight allowed them to manipulate the system long after deployment.

Reportedly, the attacker was originally involved in developing the contract for the Infini project. However, after delivering the project, they secretly retained admin rights. Over 100 days later, the attacker funded their address through the Tornado Cash mixing service, sent a small ETH transaction for gas, and exploited the contract, draining all funds from the platform.