The decentralized privacy protocol Hinkal has confirmed a security breach resulting in the theft of approximately 790,000 USDC. On July 4, 2024, attackers exploited a vulnerability within the project's Ethereum-based smart contracts to extract liquidity. Following the incident, the Hinkal team announced a proactive response strategy, including the suspension of protocol operations and a commitment to restore all user assets at a 1:1 ratio.
Analysis of the Security Breach and Asset Flow
According to technical reports from the project developers, the attacker converted the stolen 790,000 USDC into 454 ETH immediately following the exploit. Blockchain data indicates a sophisticated obfuscation process was employed to hide the trail of the digital assets.
- 410 ETH was funneled through the decentralized mixing service Tornado Cash.
- Approximately 44.67 ETH was moved to the Bitcoin network using the THORChain cross-chain protocol.
- The exploit was isolated to the Ethereum liquidity pool, leaving assets on other supported public chains unaffected.
Hinkal is a privacy-preserving layer that allows users to execute transactions on-chain without revealing sensitive data, utilizing zk-Proofs to maintain anonymity.
Protocol Response and Compensation Strategy
In the immediate aftermath of the detection, the Hinkal team suspended all protocol contracts to prevent further drainage of funds. The project is currently working alongside external security agencies to track the movement of the stolen ETH and identify the root cause of the smart contract vulnerability. A comprehensive security audit is scheduled to take place before the protocol resumes services.
All affected users' funds will be fully compensated at a 1:1 ratio. The complete compensation process and implementation timeline will be announced separately.
The commitment to full reimbursement aims to mitigate the impact on the protocol’s community and maintain trust in the decentralized finance (DeFi) ecosystem. Currently, investigators are monitoring the addresses associated with the Bitcoin network and the Ethereum blockchain to identify potential exit points at centralized exchanges.
The Hinkal incident serves as a reminder of the persistent security risks within DeFi smart contracts, even for privacy-focused protocols. While the total loss of nearly $800,000 is significant, the project's transparency regarding the 454 ETH conversion and their guarantee of financial restitution suggests a structured recovery plan is in motion. Community members are advised to follow official communication channels for updates on the compensation timeline.
Frequently Asked Questions
Quick answers to the most common questions about this topic.
For educational purposes only. Nothing here constitutes financial or investment advice. Crypto markets are highly volatile — always DYOR before making any decisions.
Fact-checked per our editorial policy. We maintain strict independence from advertisers. Spot an error? Let us know.