INK Finance (Polygon workspace treasury) hack — May 2026
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | May 11, 2026 |
| Target type | DAO or treasury |
| Loss | $140,180Price at time of incident |
| Method | Access control flawA malicious contract mimicked a whitelisted claimer entry in INK Finance's Workspace controller and, with a flash loan to satisfy a balance check, claimed the workspace treasury's USDT |
| Chains | Polygon |
| Outcome | Unresolved |
What happened
INK Finance, a governance and treasury platform for DAOs, lost 140,180 USDT from a Workspace Treasury proxy on its Polygon deployment on 11 May 2026, in a transaction at 07:24:54 UTC. Blockaid flagged it at about 13:41 UTC, and The Crypto Times reported it the same day.
According to Blockaid, as reported by The Crypto Times, the attacker deployed a contract that mimicked a whitelisted claimer entry in INK Finance's Workspace controller and used a flash loan of about $25,000 from Balancer V2 to satisfy the balance condition that the claim path checked.
This registry read the receipt: 140,180.18 USDT0 left the treasury proxy for the attacker's contract. That amount is recorded. No recovery has been reported.
Sources
- The Crypto TimesSecondary · retrieved 2026-10-06
- DeFiHackLabs exploit reconstructionSecondary · retrieved 2026-10-06
- Polygon transaction receipt, read by this registryOn-chain · retrieved 2026-10-06
Changes to this entry
- Recorded on 6 October 2026 in a backfill of 2026 incidents that this registry had missed, found through DeFiHackLabs' reproduction list. The amount was checked against the transaction receipt, read by this registry from a public node.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "INK Finance (Polygon workspace treasury) hack — May 2026", iTokenly, accessed 2026-10-06, https://itokenly.com/hacks/ink-finance-polygon-may-2026https://itokenly.com/hacks/ink-finance-polygon-may-2026Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.