The Hinkal stablecoin privacy protocol has reportedly been compromised through a smart contract vulnerability that allowed an attacker to extract approximately $820,000 worth of USDC from the system. According to reports from AMBCrypto, the suspected exploit was executed by manipulating Hinkal's prooflessDeposit() function and making a series of transact() calls. The attacker was able to access funds that should not have been accessible, suggesting a coding error that led to real financial losses.
While the precise technical defect remains unknown, the attack suggests the protocol may have failed to validate deposits or verify the cryptographic proofs underpinning Hinkal's privacy architecture. As reported by AMBCrypto, this vulnerability allowed the attacker to repeatedly call the transact() function and withdraw USDC held by the smart contract. The incident highlights smart contract code vulnerabilities as one of the most enduring threats in decentralized finance, though it does not point to fundamental flaws in DeFi itself.
This incident follows several other significant exploits in 2026, including the $7.5 million loss from the Jaredfromsubway.eth Maximal Extractable Value bot on June 20th, and a $403,000 exploit for Edel Finance involving flash loan manipulation of wrapped xStocks exchange rates. According to TRM Labs data cited by AMBCrypto, there have been 207 distinct hacks in the past six months, totaling $948.13 million in losses. Despite this increase, total losses remain less than half of the $2.3 billion stolen in the first half of 2025.
Meanwhile, institutional adoption of tokenized finance continues to expand with recent developments in the Treasury market. Tradeweb completed a real-time onchain U.S. Treasury transaction against USDCx on the Canton Network on July 1st, involving Franklin Templeton transferring a tokenized U.S. Treasury to Virtu Financial for USDCx. The transaction tested onchain settlement for U.S. Treasury instruments and tokenized dollar cash inside an institutional network, with Canton handling synchronized onchain settlement between the two assets. This development comes before DTCC's planned tokenization service rollout, which is set to launch initial limited production trades for tokenized real-world assets in July 2026 and broader service in October 2026.
