PriFi.info

Hinkal

A shielded pool on Ethereum, Solana, TRON and other chains that gives users a private balance under their existing wallet keys, with Chainalysis screening at entry; an exploit took about 797,000 USDC in July 2026.

LiveShielded pool

Hinkal paused all of its contracts after the exploit of 2 July 2026; DefiLlama still recorded TVL of about USD 62,700 on 22 October 2026, and whether every contract had been resumed was not confirmed from Hinkal's pages.

TVL
$67KDefiLlama, 29 Oct 2026
Launched
May 2023
Token
None
Chains
Ethereum, Solana, Base, Arbitrum, Polygon, BNB Chain, Optimism, TRON, Arc, Tempo and Robinhood Chain

Checked on 23 Oct 2026. Information only, not investment advice.

How it works

Hinkal is a privacy protocol: a smart contract on public chains, and a program on Solana, that holds funds users control but that nobody can attribute to them on chain. It adds a private balance to a user's existing wallet, so that the user can send, receive, swap and bridge tokens without exposing balances, counterparties or treasury activity, and it is aimed at institutions and payment platforms as well as individuals. The Block described it in April 2024 as a protocol for confidential on-chain trading by institutional investors; its documentation now presents it as privacy infrastructure for stablecoin payments, offered through Hinkal Pay, an enterprise workspace called Prime, a browser wallet, and an SDK and API for other products. Since 4 May 2026 the Polygon wallet has offered private USDC and USDT payments through Hinkal.

Signing once with the wallet deterministically restores the user's Hinkal identity and viewing keys, so there is nothing new to back up. Funds inside Hinkal are held as UTXOs, or notes: a sender computes a one-time stealth address for the recipient and creates notes for it, which only the recipient can find and spend. To spend or swap, the user's wallet proves in zero knowledge that it owns certain notes, without revealing which, and only commitments, nullifiers and Merkle roots appear on chain. The circuits are written in Circom and the EVM contracts in Solidity; the 2024 audit by zkSecurity also covered staking through hTokens and cross-chain transfers through Connext. Transactions can be posted by relayers, addresses that submit them on the user's behalf for an incentive.

Privacy is on by default, with compliance checks around it. Transactions are screened through Chainalysis KYT at entry, and high-risk addresses cannot interact with the system. Users hold access tokens, and if an access token is blacklisted the user's transactions may be reverted until it is whitelisted again. Businesses can disclose transaction records to regulators and auditors with viewing keys and downloadable history. The protocol has an admin key that controls the allowlists of relayers and tokens.

On 2 July 2026 an attacker took about 797,000 USDC from Hinkal's Ethereum contract, and the team paused all of its contracts on every chain. DefiLlama, whose daily history for Hinkal begins on 18 April 2024, recorded its highest TVL, about USD 26.8 million, on 30 July 2024, and about USD 62,700 on 22 October 2026.

TVL over time

Daily total value locked (TVL) from DefiLlama since 18 Apr 2024, with the current value refreshed every hour. The latest value is from 29 Oct 2026, 05:12 UTC. The series is in protocol-hinkal.json, listed on the Data page.

What it hides and what it does not

What it hides

  • In a private payment, the sender, the recipient and the amount.
  • Which notes a user spends: the zero-knowledge proof shows only that the user owns some of the pool's notes.
  • The link between a user's public wallet and their private balance: senders pay to one-time stealth addresses.

What it does not hide

  • Commitments, nullifiers and Merkle roots, which are on chain.
  • Funds moving between a public address and the private balance, on the public side.
  • Every address entering the system, to the screening by Chainalysis KYT, which keeps out addresses it rates high risk.
  • Transaction records a business chooses to disclose to regulators or auditors with its viewing keys.

Drawn from how it works, above; the sources are listed at the end of the page. Where privacy still leaks explains the patterns, such as timing and amounts, that can give users of any design away.

Audits

Seven security reviews, oldest first, with what each covered and found. Dates are when each report was issued, unless the entry says otherwise.

DateFirmScope and findings
Zokyo

Listed on Hinkal's security audits page among six firms that reviewed its Solidity contracts and Circom circuits; the date is taken from the report's file name. Its findings were not read for this profile.

Sources: Security audits Hinkal documentation, 23 Oct 2026; Hinkal_Zokyo_Feb20th_2024.pdf Zokyo (audit reports repository on GitHub), 20 Feb 2024
Immunefi (public audit competition)

Audit competition from 16 April to 7 May 2024, paying each participating researcher USD 2,500 plus USD 2,500 for each unique critical bug and USD 1,500 for each unique high one; Hinkal lists it as completed. The results were not read for this profile.

Sources: Hinkal IOP audit competition (information) Immunefi, 16 Apr 2024; Security audits Hinkal documentation, 23 Oct 2026
zkSecurity

One-week review from 2 September 2024 by two consultants of the Circom circuits, the Solidity contracts, the staking actions and the Connext cross-chain contracts at commit 117e8ad. It found two medium issues, a way to bypass blacklisting by minting an access token from a different address (fixed) and encrypted outputs not bound to the verified proofs (acknowledged), two low issues and two informational ones, all fixed, and noted centralisation risks around the contract owner.

Source: Hinkal audit report zkSecurity, 6 Sep 2024
Not dated Quantstamp

Listed on Hinkal's security audits page, with a Quantstamp certificate for the Hinkal protocol; no date is given there, and the report was not read for this profile.

Sources: Hinkal Protocol certificate Quantstamp; Security audits Hinkal documentation, 23 Oct 2026
Not dated Secure3

Listed on Hinkal's security audits page; no date is given there, and the report was not read for this profile.

Sources: Secure3 audit reports: Hinkal Secure3 on GitHub; Security audits Hinkal documentation, 23 Oct 2026
Not dated Hexens

Listed on Hinkal's security audits page, linked to a report file; no date is given there, and the report was not read for this profile.

Source: Security audits Hinkal documentation, 23 Oct 2026
Not dated Neodyme

Listed on Hinkal's security audits page, linked to a report file; no date is given there, and the report was not read for this profile. Hinkal also runs a bug bounty on HackenProof, whose critical issues include unauthorised withdrawal of shielded funds, forged proofs and nullifier reuse enabling double spends.

Sources: Security audits Hinkal documentation, 23 Oct 2026; Hinkal bug bounty HackenProof

Incidents

One incident that affected the project or its users.

  1. Exploit

    An attacker drained about 797,000 USDC from Hinkal's Ethereum contract. BlockSec's analysis says the attacker deposited 100 USDC through a proofless deposit and then withdrew 100 USDC again and again against that one note, later repeating it with a larger note of about 25,000 USDC, and puts the likely cause, as an inference, in a legacy note format not tightly bound to a single nullifier; it added on 9 July 2026 that the circuit code had not been open-sourced. Hinkal's update said the attacker swapped the USDC for about 454 ETH, sent about 410 ETH to Tornado Cash and moved 44.67 ETH to Bitcoin through THORChain, that only the Ethereum pools were affected, that all contracts were paused for remediation, and that affected users would be reimbursed one for one. No completed reimbursement had been found by 23 October 2026.

    Sources: Hinkal double-spend incident analysis BlockSec, 9 Jul 2026; Hinkal confirms 797K USDC stolen in attack, promises full compensation (from ChainCatcher) KuCoin News, 4 Jul 2026

Milestones

Five milestones, oldest first.

  1. Hinkal launched on Polygon's mainnet, with private assets, transfers and swaps, according to a dApp store listing; Hinkal's own blog spoke in May 2026 of three years of operation, but the month was not confirmed from Hinkal's own pages.

    Sources: Hinkal Protocol (dApp listing) Bitget Wallet DApp Store; Hinkal vs Privacy Pools vs Houdini Swap: Compliant Privacy Compared Hinkal, 21 May 2026

  2. Hinkal raised USD 1.4 million in a strategic round led by SALT Fund, structured as a SAFE with token warrants, at a valuation of USD 70 million.

    Source: Anthony Scaramucci's son leads ZK protocol Hinkal's funding round at $70 million valuation The Block, 26 Apr 2024

  3. Hinkal's TVL reached its highest daily value in DefiLlama's history, about USD 26.8 million.

    Source: Hinkal TVL (protocol data) DefiLlama, 23 Oct 2026

  4. Polygon made private payments available in the Polygon wallet through Hinkal: self-custodial users can send USDC and USDT without publishing the sender, the receiver or the amount, with Hinkal screening every private transaction before it runs.

    Source: Private payments are live on Polygon Polygon, 4 May 2026

  5. The day after the exploit, Hinkal created a public GitHub repository for its core smart contracts and Circom circuits, with no licence stated; it was last updated on 31 August 2026, and it is the scope of Hinkal's bug bounty on HackenProof, which pays up to USD 10,000 for a critical issue.

    Sources: Hinkal-Protocol/Hinkal-Contracts-Circuits (repository details) GitHub API, 23 Oct 2026; Hinkal bug bounty HackenProof

Funding

One source of funding. Amounts are in US dollars; a dash means the sources give no US dollar figure.

DateRoundAmountInvestors

Strategic round, a SAFE with token warrants, at a valuation of USD 70 million

Source: Anthony Scaramucci's son leads ZK protocol Hinkal's funding round at $70 million valuation The Block, 26 Apr 2024

 $1.4M SALT Fund, Draper Associates, SNZ Capital, Peer VC

Risks

The July 2026 exploit drained about 797,000 USDC despite six firms' reviews and public bug bounties, and no full account of its cause from Hinkal was found: BlockSec's analysis infers a flaw in a legacy note format, and the repository of contracts and circuits that Hinkal has published since July 2026 states no licence. The project holds strong powers: an admin key controls which relayers and tokens are allowed, access tokens can be blacklisted so that a user's transactions revert, the contract owner could censor users, as zkSecurity noted in 2024, and the team was able to pause every contract on every chain after the exploit. Privacy depends on how many others use each pool: DefiLlama put Hinkal's TVL at about USD 62,700 on 22 October 2026, down from about USD 26.8 million at its peak in July 2024, and it is spread over many chains, so timing and amounts of deposits and withdrawals can link them. The screening by Chainalysis KYT and the viewing keys mean that a third party judges who may enter and that records can be disclosed. A token contract can also blacklist Hinkal, which could lock balances in that token. A listing on PriFi.info is not an endorsement.

Sources

The documents this profile rests on. Each audit, incident, milestone and funding round above also links its own sources.

Checked on 23 Oct 2026. Confidence: reported. Information only, not investment, legal or tax advice.

Other profiles