What happened
On May 11, 2026, Ink Finance's Polygon treasury lost approximately 140,180 USDT through a payroll-claim exploit.
The payroll claim path did not verify that its caller was an authorized employee or duty owner and derived the payout from the treasury's current balance. An attacker could therefore impersonate a valid receiver and use flash-loaned funds to inflate the payout.
How it happened
The attacker used a Balancer flash loan to temporarily increase the treasury balance, invoked claimPayroll through an attacker-controlled receiver, received the inflated payout, and repaid the loan in the same transaction.
Protocol details
Market Context at Time of Hack
Evidence
- report @SlowMist_Team incident report x.com
- transaction Ink Finance exploit transaction on PolygonScan polygonscan.com
- analysis CryptoTimes: Ink Finance Exploited on Polygon, $140K USDT Drained in Flash Loan Attack cryptotimes.io
- analysis DeFiLlama defillama.com
- analysis INK Finance Exploit — Flash-Loan-Inflated, Permissionless claimPayroll() Treasury Drain crypto.training
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
