Skip to main content
Sign in

Hinkal Protocol

avoid.net/hinkal-protocol→28/100·72% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Summary

Hinkal Protocol is a zero-knowledge proof-based privacy DeFi protocol founded by Georgi Koreli and Nika Koreli, operating on Ethereum and multiple other chains, that enables confidential on-chain transactions for institutional users. On July 3–4, 2026, an attacker exploited a business-logic flaw in its legacy note format to drain approximately $820,000 in USDC from its Ethereum deployment — representing nearly all of the protocol's total value locked. Hinkal subsequently committed to full 1:1 user reimbursement and paused all smart contracts pending a postmortem; no confirmed recovery of stolen funds had been reported as of August 20, 2026.

Connected Entities

1 entities · 10 linked investigations
Protocols
⌂Hinkal Protocol
Relationships
    Also appears in
    edgeX Exchange·28Saga EVM Blockchain·32Mach-O Man Malware Campaign (Lazarus / Chollima)·0Q2 2026 DeFi Record Hack Wave·0Gamma Strategies·28Alephium Bridge·18Bunni Protocol·28BonkDAO Treasury Governance Attack (July 2026)·3Shunda Park Scam Compound·0Axiom DEX Insider Trading (Broox Bauer)·14
    Have evidence about Hinkal Protocol?

    Timeline(7 events)

    2022-01-01

    Hinkal Protocol founded by Georgi Koreli and Nika Koreli, incubated at Stanford.

    Tracxn / Crunchbase

    2024-04-26

    Hinkal closes a $1.4 million strategic funding round at a $70 million valuation, led by SALT Fund (AJ Scaramucci), with participation from Draper Associates, SNZ Capital, and Peer VC.

    PR Newswire

    2024-09-02

    zkSecurity completes a security audit of Hinkal's smart contracts and Circom circuits, finding six issues of medium severity or lower. No critical vulnerabilities identified.

    zkSecurity Audit Report

    2026-07-03

    Attacker at address 0xbB3f01a1b1C68F3DEB36C55342b5F5706c32fc20 exploits the prooflessDeposit() function in Hinkal's Ethereum smart contract, executing 14+ automated withdrawals of 25,000 USDC each and draining approximately $820,000 — nearly the protocol's entire TVL of $829,000. CertiK flags the attack in real time.

    CryptoTimes / Cryptopolitan / BlockSec

    2026-07-03

    Hinkal pauses all smart contracts across all chains as a precautionary measure and reports the incident to U.S. federal law enforcement.

    CryptoTimes

    2026-07-03

    Attacker converts stolen USDC to ETH, deposits approximately 410 ETH (~$700,000) into Tornado Cash, and bridges 44.67 ETH to Bitcoin via THORChain.

    CryptoTimes / Cryptopolitan

    2026-07-04

    Hinkal publicly commits to reimbursing all affected users 1:1, stating all affected funds will be returned in full. Specific process and timeline withheld pending technical fix verification.

    Crypto Adventure
    Provenance & Audit Trail
    12 Wayback Archives

    Decision Log

    • #1publish⛓ pending8/20/2026, 11:04:02 PM
      hash: HsfNGus2oa7Zjwtb7WYYPC4USfzT8sdvsJPAtBnpk9wL

    12 of 13 cited source URLs have an Internet Archive snapshot.

    full audit log →version history →

    model: claude-sonnet-4-6

    generated: 8/20/2026, 11:03:53 PM

    last updated: 8/21/2026, 6:57:12 AM

    avoid.net — verified advice for a post-truth world