Hinkal Protocol
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2wCbtK…uqSNSummary
Hinkal Protocol is a zero-knowledge proof-based privacy DeFi protocol founded by Georgi Koreli and Nika Koreli, operating on Ethereum and multiple other chains, that enables confidential on-chain transactions for institutional users. On July 3–4, 2026, an attacker exploited a business-logic flaw in its legacy note format to drain approximately $820,000 in USDC from its Ethereum deployment — representing nearly all of the protocol's total value locked. Hinkal subsequently committed to full 1:1 user reimbursement and paused all smart contracts pending a postmortem; no confirmed recovery of stolen funds had been reported as of August 20, 2026.
Connected Entities
4 entities · 60 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- THORChain→mentioned with→Ethereum(70%)
- THORChain→mentioned with→Bitcoin(60%)
- Hinkal Protocol→mentioned with→Ethereum(70%)
- Hinkal Protocol→mentioned with→THORChain(70%)
- Hinkal Protocol→mentioned with→Bitcoin(70%)
Timeline(7 events)
2022
Hinkal Protocol founded by Georgi Koreli and Nika Koreli, incubated at Stanford.
Tracxn / Crunchbase26 April 2024
Hinkal closes a $1.4 million strategic funding round at a $70 million valuation, led by SALT Fund (AJ Scaramucci), with participation from Draper Associates, SNZ Capital, and Peer VC.
PR Newswire2 September 2024
zkSecurity completes a security audit of Hinkal's smart contracts and Circom circuits, finding six issues of medium severity or lower. No critical vulnerabilities identified.
zkSecurity Audit Report3 July 2026
Attacker at address 0xbB3f01a1b1C68F3DEB36C55342b5F5706c32fc20 exploits the prooflessDeposit() function in Hinkal's Ethereum smart contract, executing 14+ automated withdrawals of 25,000 USDC each and draining approximately $820,000 — nearly the protocol's entire TVL of $829,000. CertiK flags the attack in real time.
CryptoTimes / Cryptopolitan / BlockSec3 July 2026
Hinkal pauses all smart contracts across all chains as a precautionary measure and reports the incident to U.S. federal law enforcement.
CryptoTimes3 July 2026
Attacker converts stolen USDC to ETH, deposits approximately 410 ETH (~$700,000) into Tornado Cash, and bridges 44.67 ETH to Bitcoin via THORChain.
CryptoTimes / Cryptopolitan4 July 2026
Hinkal publicly commits to reimbursing all affected users 1:1, stating all affected funds will be returned in full. Specific process and timeline withheld pending technical fix verification.
Crypto AdventureDecision Log
- hash: 7skrw2W9m3GAEs8ZwfriRnJtDxdjV2egng35gt2Rhd68
- hash: GsVCe5myra3G4zTf76VnAW4F29FSWAtnGxcdYNXoR6ZG
- hash: C138KB3KJCH4qxW7DcymhWmDp2v7v5qfySxXFYnXZpas
- hash: HsfNGus2oa7Zjwtb7WYYPC4USfzT8sdvsJPAtBnpk9wL
This investigation is cryptographically anchored to the Solana blockchain (4 events). 12 of 13 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/20/2026, 11:03:53 PM
last updated: 8/25/2026, 4:06:36 AM
3 viewsavoid.net — verified advice for a post-truth world