{"investigation":{"slug":"kinto-bridge","entity_name":"Kinto Bridge","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Kinto was a KYC-enforced Ethereum Layer 2 built on the Arbitrum Nitro stack, marketing itself as a 'safety-first' DeFi protocol with built-in AML and identity verification. On July 10, 2025, an attacker exploited a CPIMP proxy vulnerability in the $K token contract on Arbitrum, minting 110,000 unauthorized tokens and draining approximately $1.55–1.9 million from Uniswap V4 and Morpho Blue liquidity pools. Despite a partial recovery effort dubbed 'Phoenix,' the project announced shutdown effective September 30, 2025, as fundraising options collapsed and the team ran unpaid for months.","sections":[{"content":"Kinto was an Ethereum Layer 2 rollup built on the Arbitrum Nitro technology stack. It positioned itself as the first KYC-enforced L2, requiring all participants to complete identity verification via third-party providers (Onfido, Synaps, or Plaid) before transacting on-chain. A soulbound NFT ('Kinto ID') was minted to each verified wallet. The protocol marketed built-in AML screening, fraud detection, and account abstraction as distinguishing features, aiming to bridge institutional finance and DeFi. Kinto Bridge served as the canonical bridge connecting Kinto's L2 to Ethereum mainnet. The protocol launched mainnet on the Arbitrum ecosystem in May 2024 after announcing its migration from a standalone chain in November 2023. Total funding raised was approximately $5 million across seed and subsequent rounds, with investors including ParaFi Capital, Robot Ventures, SkyBridge Capital, SALT, Kraynos Capital, Modular Capital, and The Spartan Group.","heading":"Protocol Overview","sources":[{"url":"https://www.prnewswire.com/news-releases/kinto-launches-as-a-layer-2-in-arbitrum-ecosystem-301993897.html","name":"prnewswire.com","type":"other","credibility":3},{"url":"https://docs.kinto.xyz/kinto-the-safe-l2/general/litepaper","name":"docs.kinto.xyz","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2023/11/15/blockchain-startup-kinto-plans-first-kycd-ethereum-layer-2-blockchain-after-raising-5m","name":"coindesk.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/kinto-bridge","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On July 10, 2025 at 08:40 UTC, an attacker exploited a critical vulnerability in the Kinto $K token's proxy contract deployed on Arbitrum. The attack leveraged the 'CPIMP' (Clandestine Proxy In The Middle of Proxy) vulnerability — a class of deployment-time exploit targeting uninitialized ERC-1967 upgradeable proxy contracts. When the Kinto development team originally deployed the $K token proxy contract on March 19, 2025, they did not initialize it atomically in the same transaction. Within two seconds of deployment, at 20:24:42 UTC, the attacker initialized the contract first with a backdoor hidden implementation. Block explorers including Etherscan displayed the legitimate implementation while the malicious one lay dormant at a different storage offset, rendering it invisible to standard audits. On July 9, 2025 at 20:17 UTC, a public disclosure of the broader CPIMP vulnerability class was made. The attacker acted approximately 12 hours later, switching the proxy pointer to the hidden implementation, seizing owner rights, and upgrading the contract to a malicious minter. The attacker minted 110,000 $K tokens and dumped them into a Uniswap V4 liquidity pool and a Morpho Blue lending vault, draining approximately 577 ETH valued between $1.55 million and $1.9 million. Kinto's Layer 2 infrastructure, user wallets, and core chain were not compromised — the exploit was isolated to the $K token contract on Arbitrum. The $K token price collapsed approximately 90–95% within 24 hours of the attack. The protocol stated that security firm Venn Network had been coordinating a 36-hour 'war room' to patch affected protocols before public disclosure, but Kinto was not notified in time.","heading":"July 2025 Exploit: CPIMP Proxy Attack","sources":[{"url":"https://medium.com/mamori-finance/%EF%B8%8F-post-mortem-k-proxy-hack-our-path-forward-c2c3809882c6","name":"medium.com","type":"other","credibility":3},{"url":"https://thedefiant.io/news/blockchains/kinto-token-tanks-90-as-backdoor-disclosure-lets-attacker-mint-110-000-tokens-and-drain","name":"thedefiant.io","type":"other","credibility":3},{"url":"https://www.dedaub.com/blog/the-cpimp-attack-an-insanely-far-reaching-vulnerability-successfully-mitigated/","name":"dedaub.com","type":"other","credibility":3},{"url":"https://quadrigainitiative.com/casestudy/kintotokenhiddenoffnetworkproxyinitializationexploit.php","name":"quadrigainitiative.com","type":"other","credibility":3},{"url":"https://rekt.news/just-bad-luck","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.nethermind.io/blog/cpimp-attack-how-uninitialized-proxies-are-exploited-during-deployment","name":"nethermind.io","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the July 2025 exploit, Kinto launched the 'Phoenix' recovery initiative, raising just over $1 million in debt financing to restart trading and DeFi operations. The team deployed a new hardened $K token contract on Arbitrum, restored all balances to the pre-hack state at block 356170028, and reopened trading at pre-hack prices. A 90-day remediation window was granted to Morpho borrowers to repay obligations. The team also extended a one-week fairness window compensating accounts that purchased $K during the crash before the first public alert at 09:50 UTC. Despite these measures, the Phoenix funds proved insufficient to sustain the project. The team worked without pay from July onward. Subsequent fundraising efforts reportedly 'fell through,' and the foundation determined that continued operations were not viable.","heading":"Post-Exploit Recovery: Phoenix Program","sources":[{"url":"https://medium.com/mamori-finance/%EF%B8%8F-post-mortem-k-proxy-hack-our-path-forward-c2c3809882c6","name":"medium.com","type":"other","credibility":3},{"url":"https://www.cointeeth.com/news/ethereum-layer-2-project-kinto-folds-following-exploit-and-failed-1","name":"cointeeth.com","type":"other","credibility":3},{"url":"https://crypto.news/kinto-price-slides-shutdown-1-9m-hack-july-2025/","name":"crypto.news","type":"other","credibility":3}],"severity":"medium"},{"content":"On September 7, 2025, Kinto announced it would shut down all operations by September 30, 2025. The $K token fell an additional 81–85% on the announcement day, reaching a cumulative decline of approximately 94% over the prior month. Founder Ramon Recuero cited the failure of subsequent fundraising rounds and the unsustainability of unpaid operations. The orderly wind-down plan included: (1) keeping the UI, bridge, and wallet withdrawals open until September 30; (2) providing claim portal access from October 1 through November 30, 2025; (3) distributing approximately $800,000 in consolidated foundation assets to Phoenix lenders, covering roughly 76% of their principal; (4) a $55,000 personal goodwill fund contributed by Recuero, providing up to $1,100 per address to Morpho and Royco hack victims; (5) issuing Contingent Value Rights (CVR) to eligible creditors covering 100% of any future recovered proceeds up to admitted losses; and (6) an ERA airdrop distribution targeted for October 15, 2025. The development company waived all internal loans to maximize creditor recovery. Recuero and the team stated that 'the team and investors have not unlocked a single token,' directly countering allegations of a rug pull. Wildcat, a crypto lending protocol with Kinto exposure, publicly stated that Kinto's default posed 'no risk of contagion' for outstanding loans.","heading":"Shutdown and Wind-Down","sources":[{"url":"https://medium.com/mamori-finance/kinto-is-shutting-down-fca59862f0e7","name":"medium.com","type":"other","credibility":3},{"url":"https://www.theblock.co/post/369731/ethereum-layer-2-kinto-shuts-down-in-wake-of-1-6-million-july-exploit","name":"theblock.co","type":"other","credibility":3},{"url":"https://thedefiant.io/news/blockchains/ethereum-l2-kinto-shuts-down-months-after-exploit-as-fundraising-options-disappeared","name":"thedefiant.io","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/kinto-plunges-81-as-eth-l2-is-set-to-wind-down-months-after-hack","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.theblock.co/post/369879/crypto-lending-protocol-wildcat-says-kinto-default-poses-no-risk-of-contagion-for-outstanding-loans","name":"theblock.co","type":"other","credibility":3},{"url":"https://beincrypto.com/kintos-k-collapsed-before-unlocking/","name":"beincrypto.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Kinto founder Ramon Recuero previously founded Babylon Finance, a community-led decentralized asset management protocol. In April 2022, the Rari Capital protocol — which Babylon Finance had significant capital allocated to — was hacked, resulting in an $80 million loss across Rari's ecosystem and approximately $3.4 million in direct losses to Babylon Finance's investment gardens. Recuero personally funded reimbursements to affected users after Fei Protocol (Rari's parent) canceled promised compensation in June 2022. Babylon Finance subsequently shut down in late 2022. The Kinto collapse marks Recuero's second venture to fail following a third-party or protocol-level security incident. Analysts at Rekt News noted that Recuero blamed 'state actors' for the Kinto exploit, a characterization that was questioned given the precision of the attack (the attacker minted a 'suspiciously round' 110,000 tokens indicating intimate knowledge of available liquidity).","heading":"Founder History: Babylon Finance","sources":[{"url":"https://medium.com/babylon-finance/babylon-finance-is-shutting-down-b58abf1bc251","name":"medium.com","type":"other","credibility":3},{"url":"https://beincrypto.com/babylon-finance-shutters-operations-80m-rari-hack-we-failed-need-accept-it/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://rekt.news/just-bad-luck","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.ainvest.com/news/risks-realities-high-yield-defi-projects-lessons-kinto-collapse-2509/","name":"ainvest.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The $K token was deployed on June 30, 2024. The token sale was conducted at $10 per token, the same price paid by the final investor round in January 2024. The airdrop and public listing were scheduled for April 1, 2025. Tokenomics allocated 25% of the initial supply (17% of maximum supply) to investors, subject to vesting. The team held tokens under a four-year linear vest with a one-year lock, extended to April 1, 2026. The shutdown announcement on September 7, 2025 preceded the scheduled team token unlock, meaning no insider tokens were distributed before the wind-down. The $K token experienced two severe price collapses: a 90–95% crash immediately following the July 2025 exploit, and a further 81–85% decline on the September 7 shutdown announcement, leaving token holders near total losses relative to the $10 launch price. The TVL of Kinto Bridge at time of shutdown was approximately $672,000, a fraction of comparable Arbitrum-native bridges.","heading":"Token Economics and Investor Risk","sources":[{"url":"https://cryptorank.io/ico/kinto","name":"cryptorank.io","type":"other","credibility":3},{"url":"https://cryptorank.io/price/kinto/vesting","name":"cryptorank.io","type":"other","credibility":3},{"url":"https://defillama.com/protocol/kinto-bridge","name":"defillama.com","type":"other","credibility":3},{"url":"https://beincrypto.com/kintos-k-collapsed-before-unlocking/","name":"beincrypto.com","type":"other","credibility":3}],"severity":"medium"},{"content":"According to AVOID.NET's internal context, on-chain investigator ZachXBT flagged Kinto Bridge as a risky entity. Independent searches did not surface a specific dated ZachXBT post or thread naming Kinto Bridge directly; no public Tier 1 or Tier 2 source confirms the precise nature or date of the flagging. ZachXBT's general methodology involves flagging projects with exploit histories, unresolved victim losses, and founders with prior failure patterns — all of which apply to Kinto. The claim of a ZachXBT flag should be treated as alleged pending a verifiable primary source. Separately, Rekt News published an investigative article titled 'Just Bad Luck?' questioning Recuero's 'state actor' attribution and the suspicious precision of the exploit, reflecting broader community skepticism about the narrative around the hack.","heading":"ZachXBT Flag and External Scrutiny","sources":[{"url":"https://rekt.news/just-bad-luck","name":"rekt.news","type":"other","credibility":3},{"url":"https://x.com/zachxbt","name":"x.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2023-11-15","event":"Kinto raises $3.5–5 million seed round led by SALT with participation from ParaFi Capital, Robot Ventures, SkyBridge Capital, Kraynos Capital, Modular Capital, and The Spartan Group; announces migration to Arbitrum Nitro stack.","source":""},{"date":"2024-05","event":"Kinto mainnet launches on the Arbitrum ecosystem as a KYC-enforced Layer 2.","source":"","date_original":"2024-05-01"},{"date":"2024-06-30","event":"$K token contract deployed on Arbitrum.","source":""},{"date":"2025","event":"Final investor token round occurs at $10 per $K token.","source":"","date_original":"2025-01-01"},{"date":"2025-03-19","event":"Kinto developers deploy the $K token proxy on Arbitrum without atomic initialization; attacker initializes the proxy with a backdoor hidden implementation two seconds later.","source":""},{"date":"2025-04","event":"$K token airdrop and public listing proceeds; token launches at approximately $7.68.","source":"","date_original":"2025-04-01"},{"date":"2025-07-09","event":"CPIMP (ERC-1967 proxy) vulnerability publicly disclosed at 20:17 UTC; Venn Network runs a 36-hour remediation war room notifying affected protocols — Kinto is not reached in time.","source":""},{"date":"2025-07-10","event":"Attacker exploits $K token proxy at 08:40 UTC; mints 110,000 unauthorized $K tokens; drains 577 ETH (~$1.55–1.9M) from Uniswap V4 and Morpho Blue pools. Kinto issues first public alert at 09:50 UTC. $K token crashes 90–95%.","source":""},{"date":"2025-07-10","event":"Kinto freezes CEX trading, pulls remaining liquidity, and begins collaboration with ZeroShadow for on-chain investigation.","source":""},{"date":"2025-07","event":"Kinto launches Phoenix recovery initiative; raises just over $1 million in debt financing; deploys new hardened $K contract; restores balances to pre-hack block 356170028.","source":"","date_original":"2025-07-01"},{"date":"2025-09-07","event":"Kinto announces full shutdown effective September 30, 2025, citing failed fundraising and unsustainable unpaid operations. $K token falls an additional 81–85% on announcement day.","source":""},{"date":"2025-09-30","event":"Kinto L2 operations, bridge, UI, and wallets shut down. Users directed to claim portals active October 1 through November 30, 2025.","source":""},{"date":"2025-10-15","event":"ERA airdrop distribution targeted; Ethereum mainnet claim contract for hack victims launches.","source":""}],"sources_used":[{"url":"https://www.prnewswire.com/news-releases/kinto-launches-as-a-layer-2-in-arbitrum-ecosystem-301993897.html","name":"prnewswire.com","type":"other","archive_url":"https://web.archive.org/web/20260830035120/https://www.prnewswire.com/news-releases/kinto-launches-as-a-layer-2-in-arbitrum-ecosystem-301993897.html","credibility":3,"archive_timestamp":"2026-08-30T03:51:20+00:00"},{"url":"https://docs.kinto.xyz/kinto-the-safe-l2/general/litepaper","name":"docs.kinto.xyz","type":"other","archive_url":"http://web.archive.org/web/20241204091629/https://docs.kinto.xyz/kinto-the-safe-l2/general/litepaper","credibility":3,"archive_timestamp":"2024-12-04T09:16:29+00:00"},{"url":"https://www.coindesk.com/business/2023/11/15/blockchain-startup-kinto-plans-first-kycd-ethereum-layer-2-blockchain-after-raising-5m","name":"coindesk.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://defillama.com/protocol/kinto-bridge","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250915055926/https://defillama.com/protocol/kinto-bridge","credibility":3,"archive_timestamp":"2025-09-15T05:59:26+00:00"},{"url":"https://medium.com/mamori-finance/%EF%B8%8F-post-mortem-k-proxy-hack-our-path-forward-c2c3809882c6","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://thedefiant.io/news/blockchains/kinto-token-tanks-90-as-backdoor-disclosure-lets-attacker-mint-110-000-tokens-and-drain","name":"thedefiant.io","type":"other","archive_url":"http://web.archive.org/web/20250917124744/https://thedefiant.io/news/blockchains/kinto-token-tanks-90-as-backdoor-disclosure-lets-attacker-mint-110-000-tokens-and-drain","credibility":3,"archive_timestamp":"2025-09-17T12:47:44+00:00"},{"url":"https://www.dedaub.com/blog/the-cpimp-attack-an-insanely-far-reaching-vulnerability-successfully-mitigated/","name":"dedaub.com","type":"other","archive_url":"http://web.archive.org/web/20260414022508/https://dedaub.com/blog/the-cpimp-attack-an-insanely-far-reaching-vulnerability-successfully-mitigated/","credibility":3,"archive_timestamp":"2026-04-14T02:25:08+00:00"},{"url":"https://quadrigainitiative.com/casestudy/kintotokenhiddenoffnetworkproxyinitializationexploit.php","name":"quadrigainitiative.com","type":"other","archive_url":"http://web.archive.org/web/20260306114224/https://quadrigainitiative.com/casestudy/kintotokenhiddenoffnetworkproxyinitializationexploit.php","credibility":3,"archive_timestamp":"2026-03-06T11:42:24+00:00"},{"url":"https://rekt.news/just-bad-luck","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260608202423/https://rekt.news/just-bad-luck","credibility":3,"archive_timestamp":"2026-06-08T20:24:23+00:00"},{"url":"https://www.nethermind.io/blog/cpimp-attack-how-uninitialized-proxies-are-exploited-during-deployment","name":"nethermind.io","type":"other","archive_url":"http://web.archive.org/web/20260314172430/https://www.nethermind.io/blog/cpimp-attack-how-uninitialized-proxies-are-exploited-during-deployment","credibility":3,"archive_timestamp":"2026-03-14T17:24:30+00:00"},{"url":"https://www.cointeeth.com/news/ethereum-layer-2-project-kinto-folds-following-exploit-and-failed-1","name":"cointeeth.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://crypto.news/kinto-price-slides-shutdown-1-9m-hack-july-2025/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20251017013839/https://crypto.news/kinto-price-slides-shutdown-1-9m-hack-july-2025/","credibility":3,"archive_timestamp":"2025-10-17T01:38:39+00:00"},{"url":"https://medium.com/mamori-finance/kinto-is-shutting-down-fca59862f0e7","name":"medium.com","type":"other","archive_url":"http://web.archive.org/web/20260414205216/https://medium.com/mamori-finance/kinto-is-shutting-down-fca59862f0e7","credibility":3,"archive_timestamp":"2026-04-14T20:52:16+00:00"},{"url":"https://www.theblock.co/post/369731/ethereum-layer-2-kinto-shuts-down-in-wake-of-1-6-million-july-exploit","name":"theblock.co","type":"other","archive_url":"http://web.archive.org/web/20260227163517/https://www.theblock.co/post/369731/ethereum-layer-2-kinto-shuts-down-in-wake-of-1-6-million-july-exploit","credibility":3,"archive_timestamp":"2026-02-27T16:35:17+00:00"},{"url":"https://thedefiant.io/news/blockchains/ethereum-l2-kinto-shuts-down-months-after-exploit-as-fundraising-options-disappeared","name":"thedefiant.io","type":"other","archive_url":"http://web.archive.org/web/20250920093646/https://thedefiant.io/news/blockchains/ethereum-l2-kinto-shuts-down-months-after-exploit-as-fundraising-options-disappeared","credibility":3,"archive_timestamp":"2025-09-20T09:36:46+00:00"},{"url":"https://cointelegraph.com/news/kinto-plunges-81-as-eth-l2-is-set-to-wind-down-months-after-hack","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20251209203138/https://cointelegraph.com/news/kinto-plunges-81-as-eth-l2-is-set-to-wind-down-months-after-hack","credibility":3,"archive_timestamp":"2025-12-09T20:31:38+00:00"},{"url":"https://www.theblock.co/post/369879/crypto-lending-protocol-wildcat-says-kinto-default-poses-no-risk-of-contagion-for-outstanding-loans","name":"theblock.co","type":"other","archive_url":"http://web.archive.org/web/20251030073427/https://www.theblock.co/post/369879/crypto-lending-protocol-wildcat-says-kinto-default-poses-no-risk-of-contagion-for-outstanding-loans","credibility":3,"archive_timestamp":"2025-10-30T07:34:27+00:00"},{"url":"https://beincrypto.com/kintos-k-collapsed-before-unlocking/","name":"beincrypto.com","type":"other","archive_url":"http://web.archive.org/web/20251011123924/https://beincrypto.com/kintos-k-collapsed-before-unlocking/","credibility":3,"archive_timestamp":"2025-10-11T12:39:24+00:00"},{"url":"https://medium.com/babylon-finance/babylon-finance-is-shutting-down-b58abf1bc251","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://beincrypto.com/babylon-finance-shutters-operations-80m-rari-hack-we-failed-need-accept-it/","name":"beincrypto.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.ainvest.com/news/risks-realities-high-yield-defi-projects-lessons-kinto-collapse-2509/","name":"ainvest.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cryptorank.io/ico/kinto","name":"cryptorank.io","type":"other","archive_url":"https://web.archive.org/web/20260829030546/https://cryptorank.io/ico/kinto","credibility":3,"archive_timestamp":"2026-08-29T03:05:46+00:00"},{"url":"https://cryptorank.io/price/kinto/vesting","name":"cryptorank.io","type":"other","archive_url":"http://web.archive.org/web/20250907195807/https://cryptorank.io/price/kinto/vesting","credibility":3,"archive_timestamp":"2025-09-07T19:58:07+00:00"},{"url":"https://x.com/zachxbt","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:22.402848+00:00","updated_at":"2026-08-30T03:54:59.616889+00:00"}}