Verify a decision

{"actor":"system:backfill","investigation_id":"f43f16c3-3621-4014-9dc7-4a295e4706b8","kind":"publish","page_slug":"ink-finance","published_at":"2026-05-30T04:52:27.935Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"INK Finance","sections":[{"content":"On May 11, 2026, at approximately 13:41 UTC, Web3 security firm Blockaid identified and publicly flagged an active exploit against INK Finance's Workspace Treasury Proxy contract (0xa184Af4B1c01815A4B57422A3419E4FB78a96Ee4) on the Polygon network. The attacker, operating from address 0x90b147592191388e955401af43842e19faa87ee2 (subsequently labeled 'INK Finance Exploiter 1' on Polygonscan), drained approximately $140,180 in USDT0 in a single atomic transaction (0xb469a24ec737be16fe41367a7b5b315c7f03b4e0ff3af50b3a2db03b3066b982). The Workspace Treasury Proxy is an EIP-1967 beacon proxy contract first deployed on Polygon in December 2023 and not materially upgraded since. No user funds held in unrelated Workspace instances on other chains were confirmed affected at the time of initial reporting.","heading":"Exploit Overview — May 11, 2026","severity":"critical","sources":[{"credibility":2,"name":"INK Finance Exploited on Polygon, $140K USDT Drained in Flash Loan Attack — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/05/11/ink-finance-exploited-on-polygon-140k-usdt-drained-in-flash-loan-attack/"},{"credibility":1,"name":"Polygonscan — Exploit Transaction 0xb469a24ec737be16fe41367a7b5b315c7f03b4e0ff3af50b3a2db03b3066b982","type":"on_chain","url":"https://polygonscan.com/tx/0xb469a24ec737be16fe41367a7b5b315c7f03b4e0ff3af50b3a2db03b3066b982"},{"credibility":2,"name":"INK Finance Suffers $140K Drain on Polygon — Cryip","type":"news_article","url":"https://cryip.co/ink-finance-suffers-140k-drain-on-polygon-attacker-exploits-treasury-proxy-via-whitelist-flaw-and-flash-loan/"},{"credibility":2,"name":"INK Finance Treasury On Polygon Drained In $140K Exploit, Blockaid Reports — BitcoinWorld","type":"news_article","url":"https://bitcoinworld.co.in/ink-finance-polygon-treasury-hack-140k/"}]},{"content":"The exploit involved three sequenced steps executed within a single atomic transaction. First, the attacker deployed a malicious contract whose address or registration data satisfied the whitelist validation criteria embedded in INK Finance's Workspace controller — the module that governs which addresses may invoke the claim() function on a Workspace Treasury Proxy. Second, because the controller's eligibility logic did not perform secondary validation on the payout amount after passing the whitelist check, the attacker's contract was able to call claim() and trigger an authorized treasury transfer. Third, to meet any balance or collateral condition imposed by the claim path, the attacker borrowed approximately $24,982 USDT0 via a zero-fee Balancer V2 flash loan within the same transaction. The flash loan capital temporarily inflated the attacker's apparent position, enabling extraction of the full treasury balance of approximately $165,162 USDT0; after repaying the $24,982 flash loan, the net profit to the attacker was $140,180 USDT0. On-chain token transfer records from Polygonscan confirm the precise flow: Balancer V2 disbursed 24,982.65 USDT0 to the newly created attacker contract, which forwarded it to the INK Finance Treasury; the Treasury then disbursed 165,162.83 USDT0 back to the attacker contract; the attacker contract repaid 24,982.65 USDT0 to Balancer V2 and forwarded the remaining 140,180.18 USDT0 to the exploiter address.","heading":"Attack Mechanism — Whitelist Bypass and Flash Loan Amplification","severity":"critical","sources":[{"credibility":1,"name":"Polygonscan — Exploit Transaction Token Transfers","type":"on_chain","url":"https://polygonscan.com/tx/0xb469a24ec737be16fe41367a7b5b315c7f03b4e0ff3af50b3a2db03b3066b982"},{"credibility":2,"name":"INK Finance Exploited on Polygon, $140K USDT Drained in Flash Loan Attack — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/05/11/ink-finance-exploited-on-polygon-140k-usdt-drained-in-flash-loan-attack/"},{"credibility":2,"name":"INK Finance loses $140K as whitelist bypass exploit targets treasury infrastructure — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/ink-finance-loses-140k-as-whitelist-bypass-exploit-targets-treasury-infrastructure-details/"}]},{"content":"On-chain forensic analysis reported by Blockaid and covered by multiple outlets indicates that the attacker pre-funded the exploiting wallet using Railgun, an Ethereum-based privacy protocol that shields sender, receiver, and transaction amount metadata using zero-knowledge proofs. After receiving funds through Railgun on Ethereum, the attacker bridged capital to Polygon approximately 32 minutes before executing the exploit transaction, suggesting deliberate pre-staging of the attack infrastructure rather than an opportunistic discovery. No on-chain attribution linking the attacker address to a known individual or entity has been publicly reported.","heading":"Attacker Funding and Privacy Obfuscation","severity":"high","sources":[{"credibility":2,"name":"INK Finance Exploited on Polygon, $140K USDT Drained in Flash Loan Attack — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/05/11/ink-finance-exploited-on-polygon-140k-usdt-drained-in-flash-loan-attack/"},{"credibility":2,"name":"INK Finance Suffers $140K Drain on Polygon — Cryip","type":"news_article","url":"https://cryip.co/ink-finance-suffers-140k-drain-on-polygon-attacker-exploits-treasury-proxy-via-whitelist-flaw-and-flash-loan/"},{"credibility":3,"name":"ME Group (MetaEra) on X — Blockaid alert repost","type":"social_media","url":"https://x.com/MetaEraHK/status/2053770463688704268"}]},{"content":"The compromised Workspace Treasury Proxy (0xa184Af4B1c01815A4B57422A3419E4FB78a96Ee4) is an EIP-1967 beacon proxy contract that was deployed on Polygon in December 2023, according to multiple reporting sources. Multiple outlets note that the contract had received no material upgrades between its original deployment and the date of the exploit — a period of approximately 29 months. The underlying implementation contract was separately identified at address 0x72225ccb…7AFc89890. INK Finance's SALUS security audit, completed in August 2023 and covering smart contract logic, threat modeling, and business logic, preceded the deployment of this specific contract. It is not confirmed whether the Treasury Proxy contract or its whitelist logic were within the scope of the SALUS audit.","heading":"Contract Age and Upgrade History","severity":"high","sources":[{"credibility":2,"name":"INK Finance Exploited on Polygon, $140K USDT Drained in Flash Loan Attack — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/05/11/ink-finance-exploited-on-polygon-140k-usdt-drained-in-flash-loan-attack/"},{"credibility":2,"name":"Ink Finance — Into Q1, 2024 (SALUS audit reference) — Medium","type":"official","url":"https://inkfinance.medium.com/ink-finance-into-q1-2024-27ef449d16c8"},{"credibility":2,"name":"INK Finance Suffers $140K Drain on Polygon — Cryip","type":"news_article","url":"https://cryip.co/ink-finance-suffers-140k-drain-on-polygon-attacker-exploits-treasury-proxy-via-whitelist-flaw-and-flash-loan/"}]},{"content":"As of May 11, 2026 — the date of initial reporting across multiple outlets — INK Finance had not issued a formal public statement detailing the scope of the breach, a remediation timeline, or a plan for affected users. One source noted that INK Finance 'acknowledged the incident,' though a complete technical post-mortem had not been released. Security commentators recommended that users with active INK Finance Workspaces or treasury setups on Polygon revoke outstanding approvals to the Workspace controller and treasury proxy contracts, audit current claimer whitelists for unfamiliar entries, and avoid deploying fresh capital into INK-managed treasuries until a patch is confirmed on-chain. No bounty program, recovery plan, or law enforcement referral has been publicly announced as of the date of this investigation.","heading":"Project Response and Remediation","severity":"high","sources":[{"credibility":2,"name":"INK Finance Exploited on Polygon, $140K USDT Drained in Flash Loan Attack — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/05/11/ink-finance-exploited-on-polygon-140k-usdt-drained-in-flash-loan-attack/"},{"credibility":2,"name":"INK Finance Loses $140K in DeFi Treasury Exploit — Phemex News","type":"news_article","url":"https://phemex.com/news/article/ink-finance-suffers-140k-loss-in-treasury-exploit-80947"},{"credibility":2,"name":"INK Finance loses $140K as whitelist bypass exploit targets treasury infrastructure — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/ink-finance-loses-140k-as-whitelist-bypass-exploit-targets-treasury-infrastructure-details/"}]},{"content":"INK Finance describes itself as a multichain financial governance and treasury management protocol designed primarily for decentralized autonomous organizations (DAOs). The platform allows DAOs to establish creditworthiness, manage treasury assets, conduct decentralized fundraising, and interact with DeFi liquidity across multiple blockchains including Polygon, Ethereum, Avalanche, and BNB Chain. The protocol's native utility token is QUILL, which is used for staking, governance rights, and rental of platform services. The project raised approximately $4 million across two funding rounds, with a $2.5 million round completed by October 2022. Founders include Tony Tang (CEO) and Camille Zhang (co-founder), with backgrounds described as spanning traditional finance, fintech, and blockchain, with affiliations to IBM and Forbes cited in project materials. QUILL's all-time high price was approximately $1.43 in December 2024; as of May 2026 the token traded significantly below that level.","heading":"Protocol Background and Token","severity":"medium","sources":[{"credibility":2,"name":"Ink Finance expands onto the Polygon Network — Medium","type":"official","url":"https://inkfinance.medium.com/ink-finance-expands-onto-the-polygon-network-447c2facbea8"},{"credibility":2,"name":"Ink Finance (QUILL) ICO Rating, Reviews and Details — ICOholder","type":"research","url":"https://icoholder.com/en/ink-finance-1019343"},{"credibility":2,"name":"What are Ink Finance and QUILL? — BloFin Academy","type":"research","url":"https://blofin.com/academy/blofin-courses/what-are-ink-finance-and-quill"},{"credibility":2,"name":"Ink Finance Price: QUILL/USD — CoinGecko","type":"other","url":"https://www.coingecko.com/en/coins/ink-finance"}]},{"content":"The INK Finance exploit occurred on the same day as a separate $101,400 exploit against Huma Finance's deprecated V1 BaseCreditPool contracts on Polygon. Both incidents involved logic flaws in legacy or unupgraded Polygon contracts. The back-to-back exploits followed what was reported as a record-setting month for DeFi smart contract losses in April 2026. The simultaneous targeting of two distinct Polygon DeFi protocols on the same date has led some analysts to note the pattern of attackers systematically probing aged, unupgraded proxy contracts on established chains. No evidence of coordination between the two attacks has been publicly reported.","heading":"Broader Polygon Security Context — May 11, 2026","severity":"medium","sources":[{"credibility":2,"name":"Huma Finance loses $101K in Polygon exploit on same day as Ink breach — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/huma-finance-loses-101k-in-polygon-exploit/"},{"credibility":2,"name":"Huma Finance V1 Exploit on Polygon Drains $101K in USDC — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/05/11/huma-finance-v1-exploit-on-polygon-drains-101k-in-usdc/"}]}],"sources_used":[{"credibility":2,"name":"INK Finance Exploited on Polygon, $140K USDT Drained in Flash Loan Attack — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/05/11/ink-finance-exploited-on-polygon-140k-usdt-drained-in-flash-loan-attack/"},{"credibility":1,"name":"Polygonscan — Exploit Transaction 0xb469a24ec","type":"on_chain","url":"https://polygonscan.com/tx/0xb469a24ec737be16fe41367a7b5b315c7f03b4e0ff3af50b3a2db03b3066b982"},{"credibility":2,"name":"INK Finance Suffers $140K Drain on Polygon — Cryip","type":"news_article","url":"https://cryip.co/ink-finance-suffers-140k-drain-on-polygon-attacker-exploits-treasury-proxy-via-whitelist-flaw-and-flash-loan/"},{"credibility":2,"name":"INK Finance loses $140K as whitelist bypass exploit targets treasury infrastructure — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/ink-finance-loses-140k-as-whitelist-bypass-exploit-targets-treasury-infrastructure-details/"},{"credibility":2,"name":"INK Finance Loses $140K in DeFi Treasury Exploit — Phemex News","type":"news_article","url":"https://phemex.com/news/article/ink-finance-suffers-140k-loss-in-treasury-exploit-80947"},{"credibility":2,"name":"INK Finance Treasury On Polygon Drained In $140K Exploit, Blockaid Reports — BitcoinWorld","type":"news_article","url":"https://bitcoinworld.co.in/ink-finance-polygon-treasury-hack-140k/"},{"credibility":2,"name":"Ink Finance Treasury on Polygon Hacked, $140000 Lost — Binance Square","type":"news_article","url":"https://www.binance.com/en/square/post/321935805160146"},{"credibility":2,"name":"Ink Finance suffered an attack on its Workspace Treasury Proxy — PANews","type":"news_article","url":"https://www.panewslab.com/en/articles/019e161a-c19d-71db-b6b8-56c49ad72eaa"},{"credibility":2,"name":"INK Finance Treasury Proxy Exploited for ~$140K — KuCoin News (Blockaid alert)","type":"news_article","url":"https://www.kucoin.com/news/insight/POL/6a01d7fad064730007b4dfd2"},{"credibility":3,"name":"ME Group on X — Blockaid alert repost","type":"social_media","url":"https://x.com/MetaEraHK/status/2053770463688704268"},{"credibility":2,"name":"Ink Finance expands onto the Polygon Network — Medium (official)","type":"official","url":"https://inkfinance.medium.com/ink-finance-expands-onto-the-polygon-network-447c2facbea8"},{"credibility":2,"name":"Ink Finance — Into Q1, 2024 (SALUS audit) — Medium (official)","type":"official","url":"https://inkfinance.medium.com/ink-finance-into-q1-2024-27ef449d16c8"},{"credibility":2,"name":"Ink Finance (QUILL) ICO Rating, Reviews and Details — ICOholder","type":"research","url":"https://icoholder.com/en/ink-finance-1019343"},{"credibility":2,"name":"What are Ink Finance and QUILL? — BloFin Academy","type":"research","url":"https://blofin.com/academy/blofin-courses/what-are-ink-finance-and-quill"},{"credibility":2,"name":"Ink Finance Price: QUILL/USD — CoinGecko","type":"other","url":"https://www.coingecko.com/en/coins/ink-finance"},{"credibility":2,"name":"Huma Finance loses $101K in Polygon exploit on same day as Ink breach — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/huma-finance-loses-101k-in-polygon-exploit/"},{"credibility":2,"name":"Huma Finance V1 Exploit on Polygon Drains $101K in USDC — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/05/11/huma-finance-v1-exploit-on-polygon-drains-101k-in-usdc/"}],"summary":"INK Finance is a multichain DeFi governance and treasury management protocol, native token QUILL, with deployments on Polygon, Ethereum, Avalanche, and BNB Chain. On May 11, 2026, an attacker drained approximately $140,180 USDT from its Workspace Treasury Proxy contract on Polygon by exploiting a whitelist authorization flaw amplified with a Balancer V2 flash loan. The exploit was confirmed on-chain via Polygonscan; as of the time of writing the INK Finance team had not released a formal post-mortem or recovery plan.","timeline":[{"date":"2022-10-01","event":"INK Finance completes $2.5 million funding round, bringing total raised to $4 million across two rounds.","source":"ICOholder — Ink Finance project details","source_url":"https://icoholder.com/en/ink-finance-1019343"},{"date":"2022-12-01","event":"INK Finance expands to the Polygon network, enabling lower-cost DAO treasury operations.","source":"Ink Finance Medium — Polygon expansion announcement","source_url":"https://inkfinance.medium.com/ink-finance-expands-onto-the-polygon-network-447c2facbea8"},{"date":"2023-08-15","event":"SALUS security firm completes comprehensive smart contract audit, threat modeling, and business logic audit of INK Finance contracts.","source":"Ink Finance Medium — Into Q1 2024","source_url":"https://inkfinance.medium.com/ink-finance-into-q1-2024-27ef449d16c8"},{"date":"2023-12-01","event":"Workspace Treasury Proxy contract (0xa184Af4B1c01815A4B57422A3419E4FB78a96Ee4) deployed on Polygon as an EIP-1967 beacon proxy. No material upgrades are applied to this contract between deployment and the May 2026 exploit.","source":"CryptoTimes / Cryip — INK Finance exploit reporting","source_url":"https://www.cryptotimes.io/2026/05/11/ink-finance-exploited-on-polygon-140k-usdt-drained-in-flash-loan-attack/"},{"date":"2024-12-02","event":"QUILL token reaches its all-time high price of approximately $1.43.","source":"CoinGecko — QUILL price history","source_url":"https://www.coingecko.com/en/coins/ink-finance"},{"date":"2026-05-11","event":"Attacker wallet receives funds through Railgun privacy protocol on Ethereum, then bridges to Polygon approximately 32 minutes before the exploit transaction.","source":"CryptoTimes — INK Finance exploit","source_url":"https://www.cryptotimes.io/2026/05/11/ink-finance-exploited-on-polygon-140k-usdt-drained-in-flash-loan-attack/"},{"date":"2026-05-11","event":"At approximately 13:41 UTC, the attacker executes exploit transaction 0xb469a24ec737be16fe41367a7b5b315c7f03b4e0ff3af50b3a2db03b3066b982, draining 140,180.18 USDT0 from INK Finance's Workspace Treasury Proxy via a whitelist bypass and a $24,982 Balancer V2 flash loan.","source":"Polygonscan — on-chain transaction record","source_url":"https://polygonscan.com/tx/0xb469a24ec737be16fe41367a7b5b315c7f03b4e0ff3af50b3a2db03b3066b982"},{"date":"2026-05-11","event":"Blockaid publicly alerts the community to the exploit, identifying the victim contract, attacker address, and exploit transaction.","source":"KuCoin News — Blockaid alert on INK Finance exploit","source_url":"https://www.kucoin.com/news/insight/POL/6a01d7fad064730007b4dfd2"},{"date":"2026-05-11","event":"On the same day, a separate exploit drains $101,400 from Huma Finance's deprecated V1 contracts on Polygon, establishing a pattern of simultaneous attacks on aged Polygon DeFi infrastructure.","source":"Cryptopolitan — Huma Finance Polygon exploit","source_url":"https://www.cryptopolitan.com/huma-finance-loses-101k-in-polygon-exploit/"},{"date":"2026-05-11","event":"INK Finance has not issued a formal public post-mortem, recovery plan, or protocol pause announcement as of the date of initial reporting.","source":"Phemex News — INK Finance treasury exploit","source_url":"https://phemex.com/news/article/ink-finance-suffers-140k-loss-in-treasury-exploit-80947"}]},"v":1}