Attackers exploited deprecated note format in Hinkal's shielded-pool, performing unauthorized proofless deposits and bypassing proof verification for withdrawals. Attack was isolated to Ethereum.

Hinkal privacy DeFi protocol's Ethereum contract was exploited. The attacker used a "proofless deposit" vulnerability to drain approximately $820K USDC, then converted it to ETH and laundered via Tornado Cash and THORChain. The team paused contracts, limited the incident to one Ethereum pool, and committed to 1:1 user compensation.