Another day, another exploit.
Reports are doing the rounds that the Hinkal stablecoin privacy protocol may have been compromised. It appears that the suspected exploit was caused by a flaw in one of the smart contracts.
This flaw reportedly allowed an attacker to obtain approximately $820,000 worth of USDC from the system.
Initial reports suggest that the attacker stole funds that should not have been accessed. The attacker was able to do this by manipulating Hinkal’s power. no proofDeposit() function followed by creating a string process() Calls.
Technique used to carry out the attack
Although definitive technical defect It is not yet known, but the attack suggests that the protocol may fail to verify deposits or verify the cryptographic evidence that supports Hinkal’s privacy architecture.
This may have allowed the attacker to repeatedly call transact() and withdraw the USDC held by the smart contract. As a result, a coding error led to a real financial loss.
However, the suspected Hinkal exploit points to a smart contract code vulnerability that is one of the most persistent threats in decentralized finance (DeFi). While the incident does not point to a flaw in DeFi itself, it does show how implementation errors can lead to significant financial losses.
Increase in exploits in 2026
This occurred at a time when other abuses had occurred recently. On June 20, the Jaredfromsubway.eth Maximum Extractable Value (MEV) bot was exploited, resulting in $7.5 million loss.
In another example, a hacker used flash credit to manipulate the exchange rate of wrapped xStocks, resulting in approximately $403,000 exploit against Edel Finance.
When all these are put together, it is seen that frauds will increase significantly in 2026. In fact, there have been 207 different hacking incidents in the last six months. According to TRM Labs.
However, despite the increase in events, DeFiLlama data showed that the total loss reached $948.13 million. This figure is less than half of the $2.3 billion stolen in the first half of 2025.
Final Summary
- Hinkal stablecoin privacy protocol exploit resulted in the seizure of $820,000 worth of USDC.
- The attacker exploited Hinkal’s prooflessDeposit() function and then made a series of transact() calls to perform this attack.
