Kinto Plummets 85% After $1.9M Hack Forces Project Shutdown
Another crypto project bites the dust—Kinto's collapse shows just how brutal this space can get when security fails.
The $1.9M Heist That Broke the Chain
A single exploit in July drained nearly $2 million from Kinto's treasury, triggering a death spiral the team couldn't reverse. Investors bolted, liquidity vanished, and the token nosedived 85% in a classic crypto rug-pull scenario—except this time, the founders actually tried to fix it.
When 'Code Is Law' Meets 'Game Over'
Kinto's shutdown exposes the harsh reality: even well-intentioned projects can't outrun a critical vulnerability. The team announced they're winding down operations, returning remaining funds, and open-sourcing their tech—a dignified exit, but cold comfort for those holding the bag.
Another reminder that in crypto, you're not just betting on innovation—you're betting that someone won't press CTRL+ALT+DELETE on the entire project overnight.
From exploit to shutdown
The incident stemmed from a vulnerability in the ERC-1967 Proxy standard, a widely used OpenZeppelin codebase for upgradeable smart contracts. 110,000 fake Kinto tokens were minted by attackers on Arbitrum (ARB) and used to siphon funds from Uniswap (UNI) liquidity pools and Morpho (MORPHO) lending vaults.
Through its “Phoenix Program,” Kinto raised $1 million in debt and resumed trading to stabilize operations. However, mounting debt, weak market conditions, and the loss of investor confidence proved insurmountable. Fundraising efforts have stalled, and team members have not been paid since July.
Kinto’s reimbursement and next steps
Kinto says it has consolidated around $800,000 of remaining assets into a foundation-controlled safe. These funds will go first to Phoenix lenders, who are expected to recover about 76% of their principal.
Hack victims on Morpho will receive up to $1,100 each from a $55,000 goodwill grant funded personally by Kinto founder Ramon Recuero. Additional recoveries from the stolen ethereum (ETH), if successful, will be returned to victims and then shared with the community through a Snapshot vote.
Users have until Sept. 30 to withdraw assets from Kinto’s Layer-2. After that, a claim contract will be deployed on the Ethereum mainnet in October to allow users to recover balances. A scheduled ERA airdrop will still be distributed on Oct. 15.
A cautionary tale for DeFi
Kinto’s closure is just one more example of the risks that Layer-2 and DeFi projects, particularly those that rely on upgradeable smart contracts, face. The exploit has fueled renewed calls for stricter security measures, better treasury protections, and sustainable yield models.
For Kinto, the end comes with an effort to repay what it can. “We’ll shut down responsibly, return what we can today, and keep fighting for recoveries tomorrow,” the team wrote on X.
