What happened
On July 10, 2025, Kinto suffered a proxy-initialization backdoor exploit. The attacker activated a dormant backdoor, upgraded the proxy to malicious logic, minted K tokens, and drained about $1.55 million from associated liquidity pools.
How it happened
- A proxy implementation was left uninitialized, allowing an attacker to install a backdoor.
- The backdoor remained available through later contract changes.
- The attacker activated it to upgrade the proxy to malicious logic.
- The compromised proxy minted K tokens, which were used to drain liquidity.
Protocol details
Classification
Protocol Logic / Access Control
Protocol Type
Canonical Bridge
Category
Bridge Hack
Implementation language
Solidity
Protocol links
@KintoXYZ
Security review history
- Pessimistic View report
- MixBytes View report
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
