Kinto Shuts Down After $1.55M Exploit Derails Recovery Efforts

Kinto, a Layer-2 protocol on Ethereum, is shutting down on September 30 after a July 10 exploit that drained US$1.55 million in ETH and caused its native token to lose 95% of its value.
The protocol’s founder, Ramón Recuero, has announced a controlled shutdown and a limited restitution plan, which includes using remaining foundation assets to compensate lenders and a US$55,000 personal contribution to compensate Morpho users.
The breach was caused by an attacker who minted counterfeit tokens, exploiting a previously flagged vulnerability that the Kinto team was unable to patch in time.

Well, that’s it for Kinto, the self-proclaimed “modular exchange” built on the Ethereum network. The protocol is winding down on September 30 after a July 10 exploit drained 577 ETH worth US$1.55M (AU$2.33M) and erased roughly 95% of its token’s value.

The founder, Ramón Recuero, announced a controlled shutdown and a limited restitution plan. All remaining foundation assets go to Phoenix lenders, who will recover 76% of principal.

Related: Collector Crypt’s Pokémon NFT Packs Spark US$85M Surge in CARDS Token

Recuero committed US$55,000 (AU$82,500) of personal funds to compensate Morpho users left with bad debt, capped at US$1,100 (AU$1,650) per address. Victims may also opt into future distributions if funds are ever clawed back.

Every day that we go on, the funds dwindle further. We’ve operated without salaries since July, and after the last financing path fell through, we have one responsible choice left: shut down cleanly and protect users/lenders as best as possible. Plenty of teams vanish into ‘zombie mode’. We won’t. We’re doing this orderly and out in the open.

Ramón Recuero, Founder of Kinto

How It All Happened

Kinto is a layer-2 protocol built with institutions and advanced traders in mind, providing a KYC-compliant ecosystem, and some features like anti-money laundering, passkey authentication, etc. But the breach ended that pitch quite fast.

According to Rekt News, the attacker minted 110,000 counterfeit Kinto tokens on the project’s Arbitrum-based L2, dumped them into liquidity, and siphoned funds from a Morpho lending vault and a Uniswap v4 pool. The underlying flaw had been publicly flagged and the strike landed within hours. Kinto missed the window to patch and paid the price.

The team tried to reboot via “Phoenix”, a recovery initiative that aimed at raising US$1M (AU$1.50M). It mapped a new token to pre-hack balances and refilled some pools to restart trading and DeFi flows. But the recovery loans added debt that blocked fresh financing.

Needless to say, the token, K, crashed hours after the incident. The chart summarises the story pretty well: