Kinto hack — July 2025

Kinto was an Ethereum layer-2 project whose $K token also traded as an ERC-20 on Arbitrum. That token's proxy was one of hundreds compromised by what researchers named the CPIMP attack, short for Clandestine Proxy In the Middle of Proxy. Where a proxy is deployed but not initialised in the same transaction, an attacker can front-run the initialisation and write its own implementation into a storage slot, then have that implementation forward most calls to the legitimate logic while restoring itself after each transaction and spoofing the slots block explorers read. The backdoor stays dormant and invisible until it is used.

David Benchimol of Venn found the vulnerability on 8 July 2025 and alerted Dedaub; a war room with SEAL 911 and the researcher pcaversaccio mitigated most exposed contracts and, by Dedaub's account, protected tens of millions of dollars. Kinto's contract was not among those saved. Public disclosure went out on 9 July 2025, and the attacker activated the Kinto backdoor the following day, minting about 110,000 counterfeit $K and selling them, draining a Uniswap v4 pool and a Morpho Blue vault of 577 ETH, worth about $1.55 million at the time. The Block's headline rounded this to $1.6 million. The $K price fell roughly 90 to 95 percent.

Kinto stated that its layer-2 network, wallets and contracts were not themselves breached. Co-founder Ramon Recuero said all signs pointed to Lazarus; no supporting evidence was published and no government body has attributed the incident. Morpho depositors were left holding bad debt. Kinto failed to raise afterwards, announced its shutdown in September 2025, repaid Phoenix lenders about 76 percent of principal and Recuero committed personal funds toward partially reimbursing Morpho depositors.