Hinkal Protocol — Proofless Deposit Exploit — Contracts Paused, Full Reimbursement Pledged

Timeline: T0 (2026-07-02, 19:05 UTC): Attacker begins withdrawing approximately 797,000 USDC from a Hinkal contract on Ethereum via a series of 'Transact' calls, each exploiting a 'Proofless Deposit' — submitting fresh nullifier/stealth/H0/H1/calldataHash values without a corresponding valid prior deposit, per CertiK's technical analysis: 'this suggests failure of the signature scheme implementation to bind commitment and nullifier.' In each call, roughly $25K was withdrawn. T+hours (2026-07-03, 04:35 UTC): CertiK Alert publishes the first public detection, describing the EOA as having conducted multiple 'Transact' transactions following a 'Proofless Deposit' to drain ~$800K USDC from a Hinkal contract. T+shortly after: CertiK confirms the attacker swapped the drained USDC to ETH, depositing 410 ETH into Tornado Cash while bridging 44.67 ETH to BTC via THORChain. T+same day: the affected contracts are frozen as a precautionary measure (confirmed via Hinkal's official account). T+2026-07-03, 14:47 UTC: Hinkal Protocol posts an official update confirming the incident was isolated to USDC on Ethereum, no other chains affected, contracts paused pending investigation. T+2026-07-03, 23:05 UTC: Hinkal posts a detailed follow-up confirming the exact figures — ~797K USDC withdrawn starting 2026-07-02 19:05 UTC, converted to ~454 ETH, 410 ETH to Tornado Cash, 44.67 ETH bridged to Bitcoin via THORChain — and pledges that no user will lose funds, with all affected balances to be made whole 1:1 once the reimbursement process and fix are finalized. The incident has been reported to relevant US authorities. Status as of report compilation: contracts remain paused across all chains, root cause validated internally and with external security specialists, full technical breakdown and reimbursement plan still pending publication.