Hinkal July 2026 Exploit: What Happened and What Changed
On July 2, 2026, an attacker exploited a bug in one Hinkal smart contract on Ethereum and withdrew 797,000 USDC. Every affected user has been reimbursed 1:1. Hinkal replaced its contracts on every chain, zkSecurity reviewed the fix, Quantstamp audited the new contracts and circuits, and a public bug bounty has run on HackenProof since September.
Hinkal's post-mortem of the July 2026 exploit. Updated November 2026.
What happened in the Hinkal exploit?
An older note format in Hinkal's Ethereum pool let a single deposit be withdrawn more than once. On July 2, 2026, an attacker used that flaw to take 797,000 USDC from that one contract. It was a bug in the code, not a leak of keys, and contracts on other chains were not affected.
As a precaution, Hinkal paused every contract on every chain on July 3 and reported the incident to US federal law enforcement.
Did Hinkal reimburse users?
Yes. Every user affected by the July 2026 exploit was reimbursed 1:1, and the reimbursement is complete.
What changed after the exploit?
The older note format is gone. Hinkal relaunched on new contracts in July 2026, and the old contracts are retired.
The older note format is gone. New contracts went live on every chain in July 2026, and the old ones are retired.
zkSecurity reviewed the circuit fix in a report dated July 17, 2026.
Quantstamp audited the new smart contracts and zero-knowledge circuits from August 5 to 14, 2026, and reviewed the fixes on August 24 (Quantstamp's announcement).
Since September 3, 2026, a public bug bounty on HackenProof has covered the contracts and circuits, with rewards up to $10,000 for critical findings.
Is Hinkal safe to use now?
Yes, the flaw exploited in July 2026 is fixed. The contracts running today are the ones Quantstamp audited, and anyone can report a bug through the HackenProof bounty. Both 2026 reports sit next to Hinkal's earlier audits on the Security audits page in the docs. Since the relaunch, teams including Polygon Wallet and Tether's Wallet Development Kit have built Hinkal privacy into their products.
For the rest of how Hinkal protects funds and screens deposits, see Security and Compliance, or read how deposit screening works. To use Hinkal, open Hinkal App.
