Audit log

Every state-changing event for Hinkal Protocol: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-20 23:04:02Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 443,509,679

   sig

   2wCbtKEh45Tg…JKKcuqSNcopyexplorer ↗

   hash

   HsfNGus2oa7Z…tBnpk9wLcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (14447 B) ▸

   {"actor":"system:backfill","investigation_id":"fdf124d2-1bbf-496e-bfd8-259013dd6bbf","kind":"publish","page_slug":"hinkal-protocol","published_at":"2026-08-20T23:04:02.461Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Hinkal Protocol","sections":[{"content":"Hinkal Protocol is a privacy-focused DeFi protocol co-founded by Georgi Koreli and Nika Koreli, both with Stanford ties. The protocol uses ZK-SNARKs (Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge) and stealth addresses to allow users to interact with decentralized applications without exposing wallet addresses, transaction amounts, or counterparties. It supports confidential deposits, withdrawals, transfers, swaps, and broader DeFi interactions across Ethereum and several additional chains. Hinkal positioned itself as institutional-grade privacy infrastructure and reported over $500 million in historical private transaction volume before the July 2026 incident. The protocol raised a $1.4 million seed round in April 2024 from investors including SALT Fund (led by AJ Scaramucci), Draper Associates, SNZ Capital, and Peer VC, at a reported valuation of $70 million.","heading":"Overview and Background","severity":"low","sources":[{"credibility":2,"name":"Hinkal Launches Shared Privacy Protocol for Cross-Chain DeFi Privacy — Blockonomi","type":"news_article","url":"https://blockonomi.com/hinkal-launches-shared-privacy-protocol-for-cross-chain-defi-privacy/"},{"credibility":1,"name":"Hinkal Closes Strategic Funding Round — PR Newswire","type":"official","url":"https://www.prnewswire.com/news-releases/hinkal-closes-strategic-funding-round-to-advance-discreet-trading-and-position-liquidation-302128873.html"},{"credibility":2,"name":"Anthony Scaramucci's son leads ZK protocol Hinkal's funding round at $70 million valuation — The Block","type":"news_article","url":"https://www.theblock.co/post/291165/anthony-scaramucci-son-zk-protocol-hinkal-funding-valuation"}]},{"content":"On July 3–4, 2026, an attacker with the address 0xbB3f01a1b1C68F3DEB36C55342b5F5706c32fc20 exploited a critical business-logic vulnerability in Hinkal's Ethereum smart contract (0x25e5...a826), draining approximately $820,000 in USDC. According to analysis by BlockSec, the root cause was a flaw in Hinkal's legacy note format: a single deposit note was not cryptographically bound to a unique nullifier, meaning different (e, nk) pairs could produce the same commitment but different nullifiers. This enabled a double-spend pattern — one deposit could be withdrawn multiple times. The attacker initiated a prooflessDeposit() call using the legacy-format note (isNewStyle flag set to 0), then executed at least 14 transact() calls in rapid succession, each draining 25,000 USDC. The total loss of approximately $820,000 represented nearly the entire TVL of the protocol, which stood at roughly $829,000 across five chains at the time of the attack. The flaw resided in the ZK circuit logic rather than the on-chain Solidity verification; the contract correctly verified individual proofs but could not detect that one commitment generated multiple valid nullifiers. The incident was flagged in real time by blockchain security firm CertiK. The exploit was confined to the Ethereum deployment; other chain deployments were unaffected but held negligible assets.","heading":"July 2026 Smart Contract Exploit","severity":"critical","sources":[{"credibility":2,"name":"Hinkal Double-Spend Technical Analysis — BlockSec Weekly","type":"research","url":"https://blocksec.com/blog/web3-security-hinkal-double-spend"},{"credibility":2,"name":"Hinkal Protocol Reveals Initial Cause Behind $820K Ethereum Exploit — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/03/hinkal-protocol-reveals-initial-cause-behind-820k-ethereum-exploit/"},{"credibility":2,"name":"Hinkal privacy protocol exploited for $820,000 — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/hinkal-privacy-protocol-exploited-for-820000-as-attacker-funnels-stolen-funds-through-tornado-cash/"},{"credibility":2,"name":"Data: CertiK monitors Hinkal Protocol being attacked, approximately 800,000 USDC stolen — ChainCatcher","type":"on_chain","url":"https://www.chaincatcher.com/en/article/2274745"},{"credibility":2,"name":"Hinkal Protocol Smart Contract Flaw Sparks $820K USDC Exploit — KuCoin","type":"news_article","url":"https://www.kucoin.com/news/flash/hinkal-protocol-smart-contract-flaw-sparks-820k-usdc-exploit"}]},{"content":"Following the exploit, the attacker converted the stolen USDC to ETH and laundered the proceeds through two mixing and bridging services. According to on-chain tracing reported by CryptoTimes and Cryptopolitan, the attacker deposited approximately 410 ETH (valued at roughly $700,000) into Tornado Cash, and separately bridged 44.67 ETH from Ethereum to Bitcoin via THORChain, with the destination Bitcoin address beginning with bc1qr2sf. The use of Tornado Cash and the cross-chain bridge to Bitcoin significantly complicates any recovery or tracing effort. No recovery of the laundered funds had been confirmed as of August 20, 2026.","heading":"Fund Laundering via Tornado Cash and THORChain","severity":"high","sources":[{"credibility":2,"name":"Hinkal Protocol Exploited: $820K Laundered via Tornado Cash and THORChain — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/03/hinkal-protocol-exploited-820k-laundered-via-tornado-cash-thorchain/"},{"credibility":2,"name":"Hinkal privacy protocol exploited for $820,000 — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/hinkal-privacy-protocol-exploited-for-820000-as-attacker-funnels-stolen-funds-through-tornado-cash/"},{"credibility":2,"name":"Hinkal Hack: How 772,000 USDC Was Stolen and Laundered — AML Crypto","type":"research","url":"https://amlcrypto.io/blog/vzlom-hinkal-pro"}]},{"content":"Hinkal paused all smart contracts across all chains immediately following detection of the incident as a precautionary measure. The team reported the incident to U.S. federal law enforcement and engaged external security specialists to validate preliminary findings before publishing a full postmortem. In a public statement, Hinkal committed to reimbursing all affected users 1:1, stating that 'all affected funds will be returned in full.' The team indicated the exact reimbursement process and timeline would be shared once a technical fix was verified. As of the time of available reporting (early-to-mid July 2026), no confirmed details on the reimbursement mechanism or a completed postmortem had been publicly released. No information on protocol restart or resumed operations has been confirmed as of August 20, 2026.","heading":"Protocol Response and User Reimbursement","severity":"medium","sources":[{"credibility":2,"name":"Hinkal Says Users Will Be Made Whole After 797K USDC Exploit — Crypto Adventure","type":"news_article","url":"https://cryptoadventure.com/hinkal-says-users-will-be-made-whole-after-797k-usdc-exploit/"},{"credibility":2,"name":"Hinkal Protocol Reveals Initial Cause Behind $820K Ethereum Exploit — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/03/hinkal-protocol-reveals-initial-cause-behind-820k-ethereum-exploit/"}]},{"content":"Prior to the July 2026 exploit, Hinkal commissioned a security audit from zkSecurity, conducted in September 2024, covering both its Solidity smart contracts and Circom ZK circuits. The audit identified six findings: two medium-severity issues (a blacklisting bypass and unbound encrypted outputs), two low-severity issues, and two informational issues. No critical vulnerabilities were flagged. All findings were reported as addressed via client fixes or documentation updates. The audit did not identify the nullifier-binding flaw in the legacy note format that was ultimately exploited in July 2026, suggesting the vulnerability either post-dated the audit scope, was present in code not reviewed, or was missed during the review.","heading":"Prior Security Audit","severity":"medium","sources":[{"credibility":2,"name":"Audit of Hinkal Protocol Smart Contracts and Circom Circuits — zkSecurity","type":"research","url":"https://reports.zksecurity.xyz/reports/hinkal-audit/"}]}],"sources_used":[{"credibility":2,"name":"Hinkal Protocol Reveals Initial Cause Behind $820K Ethereum Exploit — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/03/hinkal-protocol-reveals-initial-cause-behind-820k-ethereum-exploit/"},{"credibility":2,"name":"Hinkal Protocol Exploited: $820K Laundered via Tornado Cash and THORChain — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/03/hinkal-protocol-exploited-820k-laundered-via-tornado-cash-thorchain/"},{"credibility":2,"name":"Hinkal privacy protocol exploited for $820,000 as attacker funnels stolen funds through Tornado Cash — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/hinkal-privacy-protocol-exploited-for-820000-as-attacker-funnels-stolen-funds-through-tornado-cash/"},{"credibility":2,"name":"Hinkal Protocol Smart Contract Flaw Sparks $820K USDC Exploit — KuCoin","type":"news_article","url":"https://www.kucoin.com/news/flash/hinkal-protocol-smart-contract-flaw-sparks-820k-usdc-exploit"},{"credibility":2,"name":"How Hinkal protocol's smart contract flaw sparked $820K USDC exploit — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/how-hinkal-protocols-smart-contract-flaw-sparked-820k-usdc-exploit/"},{"credibility":2,"name":"~$800K Lost: Hinkal Double-Spend — BlockSec Weekly","type":"research","url":"https://blocksec.com/blog/web3-security-hinkal-double-spend"},{"credibility":2,"name":"Hinkal Says Users Will Be Made Whole After 797K USDC Exploit — Crypto Adventure","type":"news_article","url":"https://cryptoadventure.com/hinkal-says-users-will-be-made-whole-after-797k-usdc-exploit/"},{"credibility":2,"name":"Audit of Hinkal Protocol Smart Contracts and Circom Circuits — zkSecurity","type":"research","url":"https://reports.zksecurity.xyz/reports/hinkal-audit/"},{"credibility":2,"name":"Data: CertiK monitors Hinkal Protocol being attacked — ChainCatcher","type":"on_chain","url":"https://www.chaincatcher.com/en/article/2274745"},{"credibility":1,"name":"Hinkal Closes Strategic Funding Round — PR Newswire","type":"official","url":"https://www.prnewswire.com/news-releases/hinkal-closes-strategic-funding-round-to-advance-discreet-trading-and-position-liquidation-302128873.html"},{"credibility":2,"name":"Anthony Scaramucci's son leads ZK protocol Hinkal's funding round at $70 million valuation — The Block","type":"news_article","url":"https://www.theblock.co/post/291165/anthony-scaramucci-son-zk-protocol-hinkal-funding-valuation"},{"credibility":2,"name":"Hinkal Hack: How 772,000 USDC Was Stolen and Laundered — AML Crypto","type":"research","url":"https://amlcrypto.io/blog/vzlom-hinkal-pro"},{"credibility":2,"name":"Hinkal Loses $820K in USDC After Smart Contract Flaw Hit on July 4 — The Currency Analytics","type":"news_article","url":"https://thecurrencyanalytics.com/stable-coins/hinkal-loses-820k-in-usdc-after-smart-contract-flaw-hit-on-july-4-272635"}],"summary":"Hinkal Protocol is a zero-knowledge proof-based privacy DeFi protocol founded by Georgi Koreli and Nika Koreli, operating on Ethereum and multiple other chains, that enables confidential on-chain transactions for institutional users. On July 3–4, 2026, an attacker exploited a business-logic flaw in its legacy note format to drain approximately $820,000 in USDC from its Ethereum deployment — representing nearly all of the protocol's total value locked. Hinkal subsequently committed to full 1:1 user reimbursement and paused all smart contracts pending a postmortem; no confirmed recovery of stolen funds had been reported as of August 20, 2026.","timeline":[{"date":"2022-01-01","event":"Hinkal Protocol founded by Georgi Koreli and Nika Koreli, incubated at Stanford.","source":"Tracxn / Crunchbase","source_url":"https://tracxn.com/d/companies/hinkal/__ZTn0a749wkLHEvgcmr-DKbzQ4mGSaDjUViVojgcVX4c"},{"date":"2024-04-26","event":"Hinkal closes a $1.4 million strategic funding round at a $70 million valuation, led by SALT Fund (AJ Scaramucci), with participation from Draper Associates, SNZ Capital, and Peer VC.","source":"PR Newswire","source_url":"https://www.prnewswire.com/news-releases/hinkal-closes-strategic-funding-round-to-advance-discreet-trading-and-position-liquidation-302128873.html"},{"date":"2024-09-02","event":"zkSecurity completes a security audit of Hinkal's smart contracts and Circom circuits, finding six issues of medium severity or lower. No critical vulnerabilities identified.","source":"zkSecurity Audit Report","source_url":"https://reports.zksecurity.xyz/reports/hinkal-audit/"},{"date":"2026-07-03","event":"Attacker at address 0xbB3f01a1b1C68F3DEB36C55342b5F5706c32fc20 exploits the prooflessDeposit() function in Hinkal's Ethereum smart contract, executing 14+ automated withdrawals of 25,000 USDC each and draining approximately $820,000 — nearly the protocol's entire TVL of $829,000. CertiK flags the attack in real time.","source":"CryptoTimes / Cryptopolitan / BlockSec","source_url":"https://www.cryptotimes.io/2026/07/03/hinkal-protocol-exploited-820k-laundered-via-tornado-cash-thorchain/"},{"date":"2026-07-03","event":"Hinkal pauses all smart contracts across all chains as a precautionary measure and reports the incident to U.S. federal law enforcement.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/07/03/hinkal-protocol-reveals-initial-cause-behind-820k-ethereum-exploit/"},{"date":"2026-07-03","event":"Attacker converts stolen USDC to ETH, deposits approximately 410 ETH (~$700,000) into Tornado Cash, and bridges 44.67 ETH to Bitcoin via THORChain.","source":"CryptoTimes / Cryptopolitan","source_url":"https://www.cryptotimes.io/2026/07/03/hinkal-protocol-exploited-820k-laundered-via-tornado-cash-thorchain/"},{"date":"2026-07-04","event":"Hinkal publicly commits to reimbursing all affected users 1:1, stating all affected funds will be returned in full. Specific process and timeline withheld pending technical fix verification.","source":"Crypto Adventure","source_url":"https://cryptoadventure.com/hinkal-says-users-will-be-made-whole-after-797k-usdc-exploit/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 023a6487-09b5-4a64-8456-466b141641d4copy
2. #2reviewby reviewerreviewer

   2026-08-25 04:06:36Z
   Score: 28 → 28 (no score change)
   The page's core narrative -- a nullifier-binding double-spend flaw in Hinkal's legacy note format drained roughly $800K in USDC on July 3, 2026, followed by Tornado Cash/THORChain laundering, a contract pause, and a 1:1 reimbursement pledge -- is well supported by its cited sources and independent corroboration. The main weaknesses are: an undisclosed spread in the total-loss figure ($772K-$830K across the page's own cited outlets, one of which explicitly frames $797K as a downward revision of the $820K figure the page uses throughout); a simplified description of the exploit's transaction pattern that does not fully match the page's own primary technical source; an unsourced $500M cumulative-volume figure traceable only to the protocol's own marketing; an incomplete funding history that omits an earlier, larger seed round; and a 'current status' framing that appears to predate a July 20, 2026 reimbursement-process announcement found via independent research.
   anchoranchored

   chain

   ●mainnet-betaslot 443,511,819

   sig

   2GG21uPcvEjD…nPcYMwoScopyexplorer ↗

   hash

   C138KB3KJCH4…FYnXZpascopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1324 B) ▸

   {"actor":"reviewer","decided_at":"2026-08-25T04:06:36.562Z","decision":"review","investigation_id":"fdf124d2-1bbf-496e-bfd8-259013dd6bbf","new_score":28,"page_slug":"hinkal-protocol","prev_score":28,"reason":"The page's core narrative -- a nullifier-binding double-spend flaw in Hinkal's legacy note format drained roughly $800K in USDC on July 3, 2026, followed by Tornado Cash/THORChain laundering, a contract pause, and a 1:1 reimbursement pledge -- is well supported by its cited sources and independent corroboration. The main weaknesses are: an undisclosed spread in the total-loss figure ($772K-$830K across the page's own cited outlets, one of which explicitly frames $797K as a downward revision of the $820K figure the page uses throughout); a simplified description of the exploit's transaction pattern that does not fully match the page's own primary technical source; an unsourced $500M cumulative-volume figure traceable only to the protocol's own marketing; an incomplete funding history that omits an earlier, larger seed round; and a 'current status' framing that appears to predate a July 20, 2026 reimbursement-process announcement found via independent research.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 533ee931-e320-4b2d-b158-3392ab3e57f0copy
3. #3review reviseby judgejudge

   2026-08-25 04:06:36Z
   Score: 28 → 20 (-8)
   The page's central narrative -- the July 2026 nullifier-binding exploit, the attacker's address, the Tornado Cash/THORChain laundering path, the contract pause, and the reimbursement pledge -- is independently corroborated with zero disputed claims (disputed_pct 0.05). However, the review found four framing and sourcing problems that a raw disputed-claim count does not capture: the page states the loss as a flat '$820,000' throughout even though its own cited sources report a real spread (claim_findings[7]: $772K-$830K, with one source explicitly noting $797K as a downward revision of the $820K figure the page uses); a '$500 million in historical private transaction volume' figure is not supported by any of the three sources cited for it and traces only to the protocol's own marketing copy (claim_findings[2]); the April 2024 raise is labeled a 'seed round' though the issuer calls it a 'strategic funding round,' and an earlier, larger $4.1M seed round from November 2023 is omitted entirely (claim_findings[3]); and the 'Protocol Response' section's 'as of August 20, 2026' status claim appears to predate a July 20, 2026 reimbursement-process announcement identified by the reviewer, albeit from a single source at moderate confidence (claim_findings[16], coverage_gaps[0], flagged high priority). Under the review rubric, a high-priority coverage gap warrants a revise verdict even when disputed_pct alone sits in the approve band, and that is the deciding factor here.
   anchoranchored

   chain

   ●mainnet-betaslot 443,511,832

   sig

   48m2D3SbUiAy…HZDehPDZcopyexplorer ↗

   hash

   GsVCe5myra3G…YNXoR6ZGcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1840 B) ▸

   {"actor":"judge","decided_at":"2026-08-25T04:06:36.562Z","decision":"review_revise","investigation_id":"fdf124d2-1bbf-496e-bfd8-259013dd6bbf","new_score":20,"page_slug":"hinkal-protocol","prev_score":28,"reason":"The page's central narrative -- the July 2026 nullifier-binding exploit, the attacker's address, the Tornado Cash/THORChain laundering path, the contract pause, and the reimbursement pledge -- is independently corroborated with zero disputed claims (disputed_pct 0.05). However, the review found four framing and sourcing problems that a raw disputed-claim count does not capture: the page states the loss as a flat '$820,000' throughout even though its own cited sources report a real spread (claim_findings[7]: $772K-$830K, with one source explicitly noting $797K as a downward revision of the $820K figure the page uses); a '$500 million in historical private transaction volume' figure is not supported by any of the three sources cited for it and traces only to the protocol's own marketing copy (claim_findings[2]); the April 2024 raise is labeled a 'seed round' though the issuer calls it a 'strategic funding round,' and an earlier, larger $4.1M seed round from November 2023 is omitted entirely (claim_findings[3]); and the 'Protocol Response' section's 'as of August 20, 2026' status claim appears to predate a July 20, 2026 reimbursement-process announcement identified by the reviewer, albeit from a single source at moderate confidence (claim_findings[16], coverage_gaps[0], flagged high priority). Under the review rubric, a high-priority coverage gap warrants a revise verdict even when disputed_pct alone sits in the approve band, and that is the deciding factor here.","score_delta":-8,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ff136e1b-28c9-4215-a5e1-3bd6cae41ce2copy
4. #4reviewby reviewerreviewer

   2026-09-09 03:05:22Z
   Score: 20 → 20 (no score change)
   Findings-only fact-check (retroactive anchor of stored findings)
   anchoranchored

   chain

   ●mainnet-betaslot 445,507,265

   sig

   5GvA8eV1JTAG…PMSyKDZbcopyexplorer ↗

   hash

   7skrw2W9m3GA…gt2Rhd68copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (708 B) ▸

   {"actor":"reviewer","artifact_identity":"a968705a49519c6430f4ce9567e28c1f","decided_at":"2026-09-07T12:04:28.604801+00:00","decision":"review","findings_count":24,"findings_rows_hash":"5c4554e2bf7d15b24bd6b06718c1b3187bddb646b5f6a122999cc57885667735","investigation_id":"fdf124d2-1bbf-496e-bfd8-259013dd6bbf","mode":"findings_only_retroactive","new_score":20,"page_content_hash":"b34a51ab952ae6be080dfef07fb38d4d944bad07a5d3ae5f734b139dd98e8ef4","page_slug":"hinkal-protocol","prev_score":20,"reason":"Findings-only fact-check (retroactive anchor of stored findings)","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 376274f6-27dc-40fa-8c66-fb06a5b23662copy