- Kinto’s $K token plunged 99% after the Arbitrum mint contract exploit.
- Hacker minted 7M tokens and drained USDC via the Morpho lending platform.
- Kinto says user funds are safe and a full investigation is underway.
Kinto Network has suffered a severe blow after a smart contract exploit linked to its Arbitrum deployment, leading to the collapse of the K token’s value.
Within just 24 hours, the price of the $K token plummeted by over 99%, shocking investors and triggering a wave of uncertainty across the decentralised finance (DeFi) space.
The breach, which originated from a minting contract on Arbitrum and not the Kinto mainnet itself, enabled the unauthorised creation of millions of tokens, ultimately undermining trust in the project’s token economy.
The exploit originated off the Kinto Network
Kinto confirmed that the exploit occurred off-network, specifically on the Arbitrum version of the K token’s mint contract, which had not been adequately secured against unauthorised minting.
Although the main Kinto network, wallets, and bridge vaults remained unaffected, the attacker managed to mint nearly 7 million K tokens—more than three times the previously circulating supply of fewer than 2 million tokens.
According to early on-chain analysis, the malicious actor did not immediately dump the tokens on public exchanges but instead began to slowly manipulate the market to maximise the token’s apparent value.
This stealthy approach allowed the attacker to use the inflated token price as leverage on Morpho, a DeFi lending platform, where they deposited the newly minted tokens as collateral.
Shortly after, the hacker borrowed large sums of USDC and subsequently withdrew the funds, leaving the protocol and the broader market exposed to significant losses.
Morpho Protocol has been left holding worthless tokens
One of the most significant aftershocks of the exploit is the collateral damage inflicted on Morpho, the protocol where the attacker deposited the inflated $K tokens.
With the token’s value now decimated, Morpho is left holding tokens that are essentially worthless, raising concerns about how the platform will manage the bad debt and mitigate the financial hit.
This event underscores the systemic risks associated with DeFi platforms that rely heavily on collateralized assets whose value can be manipulated.
Although Kinto has not disclosed how much USDC was drained from Morpho, recovery efforts are reportedly ongoing.
The rapid K price decline has sparked panic
In just one hour after the exploit on Thursday, the K token’s value collapsed by 45%, sparking a rapid selloff that wiped out more than 99% of its value in total by Friday.
The token, which had reached an all-time high of $11.89 in late March 2025, hit a new all-time low of $0.4854 according to CoinMarketCap data.
At the time of writing, the token is trading at $0.7053, down over 99.15% from its peak just three months ago, with a market cap of approximately $1.29 million.
Trading volume had surged to over $2.72 million in 24 hours as investors rushed to exit positions, further exacerbating the collapse.
Kinto has engaged third parties to investigate the exploit
Following the exploit, Kinto quickly issued a public statement, assuring users that their mainnet funds and bridge vaults were not affected.
However, the company acknowledged the seriousness of the incident and has since brought in third-party security experts, including Hypernative, Seal 911, Venn, and Zeroshadow, to investigate the exploit and assist with recovery efforts.
Kinto community. We are looking into the situation ourselves and with third parties (Hypernative, Seal 911) – as soon as we have a clear picture of what has happened we will make an announcement.
— Kinto (@KintoXYZ) July 10, 2025
Kinto has pledged full transparency and is expected to release a comprehensive report once the investigation concludes.
Despite the assurance, market confidence remains shaken, with users on social media criticising the project’s contract design and the apparent lack of rigorous security audits.
Some community members expressed frustration with what they view as a pattern of poorly vetted DeFi projects harming retail investors.
While Kinto has stated that no insiders sold tokens during the crash and that token unlocks remain scheduled for April 2026, speculation continues to swirl around whether the exploit could have been prevented.
The project’s future now hinges on how effectively it can regain trust, patch security vulnerabilities, and recover lost value.
Until then, the $K token will likely remain volatile, as traders weigh the risks of staying in a project shaken to its core by a devastating exploit.
