INK Finance
Summary
INK Finance is a multichain DeFi governance and treasury management protocol, native token QUILL, with deployments on Polygon, Ethereum, Avalanche, and BNB Chain. On May 11, 2026, an attacker drained approximately $140,180 USDT from its Workspace Treasury Proxy contract on Polygon by exploiting a whitelist authorization flaw amplified with a Balancer V2 flash loan. The exploit was confirmed on-chain via Polygonscan; as of the time of writing the INK Finance team had not released a formal post-mortem or recovery plan.
Connected Entities
1 entities · 10 linked investigationsTimeline(10 events)
2022-10-01
INK Finance completes $2.5 million funding round, bringing total raised to $4 million across two rounds.
ICOholder — Ink Finance project details2022-12-01
INK Finance expands to the Polygon network, enabling lower-cost DAO treasury operations.
Ink Finance Medium — Polygon expansion announcement2023-08-15
SALUS security firm completes comprehensive smart contract audit, threat modeling, and business logic audit of INK Finance contracts.
Ink Finance Medium — Into Q1 20242023-12-01
Workspace Treasury Proxy contract (0xa184Af4B1c01815A4B57422A3419E4FB78a96Ee4) deployed on Polygon as an EIP-1967 beacon proxy. No material upgrades are applied to this contract between deployment and the May 2026 exploit.
CryptoTimes / Cryip — INK Finance exploit reporting2024-12-02
QUILL token reaches its all-time high price of approximately $1.43.
CoinGecko — QUILL price history2026-05-11
Attacker wallet receives funds through Railgun privacy protocol on Ethereum, then bridges to Polygon approximately 32 minutes before the exploit transaction.
CryptoTimes — INK Finance exploit2026-05-11
At approximately 13:41 UTC, the attacker executes exploit transaction 0xb469a24ec737be16fe41367a7b5b315c7f03b4e0ff3af50b3a2db03b3066b982, draining 140,180.18 USDT0 from INK Finance's Workspace Treasury Proxy via a whitelist bypass and a $24,982 Balancer V2 flash loan.
Polygonscan — on-chain transaction record2026-05-11
Blockaid publicly alerts the community to the exploit, identifying the victim contract, attacker address, and exploit transaction.
KuCoin News — Blockaid alert on INK Finance exploit2026-05-11
On the same day, a separate exploit drains $101,400 from Huma Finance's deprecated V1 contracts on Polygon, establishing a pattern of simultaneous attacks on aged Polygon DeFi infrastructure.
Cryptopolitan — Huma Finance Polygon exploit2026-05-11
INK Finance has not issued a formal public post-mortem, recovery plan, or protocol pause announcement as of the date of initial reporting.
Phemex News — INK Finance treasury exploitDecision Log
- hash: ATKx8NTSx5WupUFN96cxuXTZG1Sa8hC4RoDLpAec6G87
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-code-investigator
generated: 5/30/2026, 4:52:14 AM
last updated: 5/30/2026, 4:52:28 AM
avoid.net — verified advice for a post-truth world