Back
Hinkal Protocol says attacker drained about 797,000 USDC from Ethereum contracts

Hinkal Protocol says attacker drained about 797,000 USDC from Ethereum contracts

Hinkal said only Ethereum-related pools were affected, paused the affected contracts, and said impacted users will be repaid 1:1 after funds were routed through Tornado Cash and THORChain.

BTC
ETH
USDC

Fact Check
The primary source CertiK Alert directly reports the exploit draining ~$800K USDC via multiple 'Transact' transactions after a 'Proofless Deposit,' matching the claim's core assertion. Cryptopolitan confirms ~$820K (near-total TVL) with laundering through Tornado Cash and Thorchain, and PeckShield corroboration. Odaily independently corroborates. The stated amount (~$800K), the proofless deposit method, and the routing through Ethereum, Tornado Cash, and THORChain are all substantiated across the primary alert and multiple independent outlets.
    Reference: 123
Summary

Hinkal Protocol said an attacker drained about 797,000 USDC from its Ethereum contracts, prompting the protocol to pause the affected smart contracts while it investigates. Hinkal said only Ethereum-related pools were affected and that impacted users will be repaid in full on a 1:1 basis, with compensation details to follow. Earlier estimates from DeFiLlama, CertiK, PeckShield and on-chain investigator Specter had placed the loss at roughly $800,000 to $830,000 and suggested it nearly matched the protocol’s assets at the time. Hinkal said the attacker converted the stolen funds into about 454 ETH, sending about 410 ETH to Tornado Cash and bridging 44.67 ETH to Bitcoin through THORChain.

Terms & Concepts
  • smart contracts: Self-executing code on a blockchain that automates transactions and protocol operations.
  • Tornado Cash: A crypto mixing protocol used to obscure onchain transaction trails.
  • THORChain: A cross-chain liquidity protocol used to move assets between different blockchains without a centralized intermediary.