Security at Hinkal

Hinkal's smart contracts and zero-knowledge circuits have been reviewed by six independent audit firms. They are covered by a live bug bounty on HackenProof. And every deposit is screened against Chainalysis before it reaches a private balance.

Here is each layer, with the reports.

Audits Bug bounty Screening Selective disclosure Official channels FAQ

Independent audits

Six firms have reviewed Hinkal's Solidity contracts, its Circom circuits, and how the two interact.

The zero-knowledge layer is audited separately from the on-chain layer. A bug in either would break the privacy guarantees.

Firm

Status

Report

zkSecurity

Completed

2026 report Earlier report

Quantstamp

Completed

2026 report Certificate

Zokyo

Completed

Report, 20 Feb 2024

Hexens

Completed

Report

Neodyme

Completed

Report

Secure3

Completed

Bug bounty

Hinkal's contracts and circuits are open to independent security researchers on HackenProof. Rewards go up to $10,000 for critical vulnerabilities.

Critical

$5,000 to $10,000

High

$100 to $500

In scope: the Hinkal-Contracts-Circuits repository, which holds Hinkal's core smart contracts and circuits. An earlier program on Immunefi is complete.

Found an issue? Report it through HackenProof, not publicly.

View the bug bounty

Screening on every deposit

Screened at entry

Every deposit is screened against Chainalysis before it enters a private balance. Each deposit gets a depositId, permanently linked to the wallet that made it.

Checked on every move

To deposit, transfer privately or withdraw, a user proves in zero knowledge that their funds are not tied to a sanctioned or high-risk depositId. The proof is checked against Chainalysis data as it stands now, not as it stood at deposit time.

Re-screened after deposit

Screening continues after the deposit. If an address is flagged later, its funds lose access to private transfers and can only be withdrawn publicly, back to the original address.

Screening covers wallet addresses, not identity. Hinkal performs no KYC and collects no personal information.

Selective disclosure

Confidential does not mean anonymous. Users decide who sees their activity.

Viewing keys

Share full transaction history, or specific transactions or a time range, with an auditor, regulator or counterparty.

Downloadable history

Export a complete record of your own activity when it is needed.

Hinkal is not a mixer. Every deposit stays linked to the address that made it, and the protocol enforces screening rather than bypassing it.

How compliance works

Official domains and contracts

Phishing sites copy crypto brands. Check the address before you connect a wallet.

Websites

hinkal.io

Main site

pay.hinkal.io

Hinkal Pay

prime.hinkal.io

Hinkal Prime

partner.hinkal.io

Partner Portal

api.hinkal.io

Hinkal API

hinkal-team.gitbook.io/hinkal

Documentation

Accounts

@hinkal_protocol

linkedin.com/company/hinkal

github.com/Hinkal-Protocol

GitHub

t.me/hinkal_protocol

discord.com/invite/xYGJTJbZy7

Discord

support@hinkal.pro

Support email

Main Hinkal contract

0x7cb60446d7635C68EDf1c568cac74A1f98c1Cfa4

Ethereum, Arbitrum, Polygon, Base, BNB, Tempo, Arc

8LLNFE62Lr9rJLvmPsTsFttrcmwYrEykZwvpyYDW4Nc2

Solana

TDybyktjKwcuLdcuroUJABT7pQE5WDYeqa

Tron

Full list of contract addresses

These are Hinkal's only official channels. Anyone contacting you from elsewhere and claiming to represent Hinkal, or asking for your keys, recovery phrase or funds, is a scam. The team will never ask for those.

Hinkal is self-custodial. Your recovery phrase is the only backup, and Hinkal cannot recover a wallet.

FAQ

Is Hinkal safe?

Hinkal's contracts and circuits have been reviewed by six independent audit firms and are covered by a live bug bounty on HackenProof. Every deposit is screened against Chainalysis before it reaches a private balance. The reports are linked above.

Has Hinkal been audited?

Yes, by six firms: zkSecurity, Quantstamp, Zokyo, Hexens, Neodyme and Secure3.

Does Hinkal have a bug bounty?

Yes. It runs on HackenProof, with rewards up to $10,000 for critical vulnerabilities.

Is Hinkal a mixer?

No. Every deposit is screened against Chainalysis and stays linked to the address that made it. Viewing keys let users disclose their activity to auditors and regulators.

Does Hinkal require KYC?

No. Screening covers wallet addresses through Chainalysis. Hinkal collects no personal information.