Hinkal Protocol
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 20 → 52. Problems weighed by who is responsible: incidents the subject suffered −16, problems around the subject, caused by others −1.9; legitimacy credit long-running +8; a recent unresolved incident −13.2; fact-check adjustments (−8) now shown as page reliability, not in the score. Version history →
Why this score
| Every page starts at | 65 |
| Incidents it suffered (e.g. hacks) | -16 |
| Problems around it, caused by others | -1.9 |
| Long-running | +8 |
| Recent unresolved incident | -13.2 |
| Sum | 42 |
Score: 52/100 (kept between 0 and 100)
How scoring works →Summary
Hinkal Protocol is a zero-knowledge proof-based privacy DeFi protocol founded by Georgi Koreli and Nika Koreli, operating on Ethereum and multiple other chains, that enables confidential on-chain transactions for institutional users. On July 3–4, 2026, an attacker exploited a business-logic flaw in its legacy note format to drain approximately $820,000 in USDC from its Ethereum deployment — representing nearly all of the protocol's total value locked. Hinkal subsequently committed to full 1:1 user reimbursement and paused all smart contracts pending a postmortem; no confirmed recovery of stolen funds had been reported as of August 20, 2026.
Connected Entities
4 entities · 60 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- THORChain→mentioned with→Ethereum(70%)
- THORChain→mentioned with→Bitcoin(60%)
- Hinkal Protocol→mentioned with→Bitcoin(70%)
- Hinkal Protocol→mentioned with→THORChain(70%)
- Hinkal Protocol→mentioned with→Ethereum(70%)
Timeline(7 events)
2022
Hinkal Protocol founded by Georgi Koreli and Nika Koreli, incubated at Stanford.
Tracxn / Crunchbase26 April 2024
Hinkal closes a $1.4 million strategic funding round at a $70 million valuation, led by SALT Fund (AJ Scaramucci), with participation from Draper Associates, SNZ Capital, and Peer VC.
PR Newswire2 September 2024
zkSecurity completes a security audit of Hinkal's smart contracts and Circom circuits, finding six issues of medium severity or lower. No critical vulnerabilities identified.
zkSecurity Audit Report3 July 2026
Attacker at address 0xbB3f01a1b1C68F3DEB36C55342b5F5706c32fc20 exploits the prooflessDeposit() function in Hinkal's Ethereum smart contract, executing 14+ automated withdrawals of 25,000 USDC each and draining approximately $820,000 — nearly the protocol's entire TVL of $829,000. CertiK flags the attack in real time.
CryptoTimes / Cryptopolitan / BlockSec3 July 2026
Hinkal pauses all smart contracts across all chains as a precautionary measure and reports the incident to U.S. federal law enforcement.
CryptoTimes3 July 2026
Attacker converts stolen USDC to ETH, deposits approximately 410 ETH (~$700,000) into Tornado Cash, and bridges 44.67 ETH to Bitcoin via THORChain.
CryptoTimes / Cryptopolitan4 July 2026
Hinkal publicly commits to reimbursing all affected users 1:1, stating all affected funds will be returned in full. Specific process and timeline withheld pending technical fix verification.
Crypto AdventureDecision Log
- slot 455369894 · hash 6aEKn3qdabrXcQRkCh63GkmsBobA2SJgtu4CaTayTcGU
- slot 445507265 · hash 7skrw2W9m3GAEs8ZwfriRnJtDxdjV2egng35gt2Rhd68
- slot 443511832 · hash GsVCe5myra3G4zTf76VnAW4F29FSWAtnGxcdYNXoR6ZG
- slot 443511819 · hash C138KB3KJCH4qxW7DcymhWmDp2v7v5qfySxXFYnXZpas
- slot 443509679 · hash HsfNGus2oa7Zjwtb7WYYPC4USfzT8sdvsJPAtBnpk9wL
This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 12 of 13 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/20/2026, 11:03:53 PM
last updated: 10/10/2026, 6:49:41 PM
3 viewsavoid.net — verified advice for a post-truth world