Ethereum Layer-2 project Kinto is officially closing its doors this month after a devastating exploit in July drained its reserves and left the team unable to secure fresh funding.
On September 7, the team announced on X that operations will end on September 30, with withdrawals remaining open until then. Afterward, a claim contract will go live on Ethereum in October, alongside a scheduled ERA airdrop on October 15.
The news triggered massive volatility in the project’s token, with K sliding 85% in 24 hours and now down 94% over the past month.
From exploit to shutdown
The collapse traces back to a vulnerability in the ERC-1967 Proxy standard, part of the widely used OpenZeppelin codebase for upgradeable contracts. Attackers exploited the flaw to mint 110,000 fake Kinto tokens on Arbitrum, which were then used to drain liquidity from Uniswap pools and Morpho lending vaults, stealing around 577 ETH (worth $1.9 million at the time).
In an effort to recover, Kinto launched its “Phoenix Program”, raising $1 million in debt and resuming trading. But heavy liabilities, poor market conditions, and evaporating investor confidence proved impossible to overcome. By September, fundraising had stalled, and the team admitted they had gone unpaid since July.
What users can expect
Kinto has consolidated about $800,000 of remaining assets into a foundation-controlled safe. These funds will be used to cover obligations in the following order:
- Phoenix lenders → Expected to recover about 76% of their principal.
- Hack victims on Morpho → Eligible for $1,100 goodwill grants each, funded personally by Kinto founder Ramon Recuero from a $55,000 pool.
- Future recoveries → Any ETH recovered from the hack will first go to victims and then be distributed to the wider community through a Snapshot governance vote.
Withdrawals on Kinto remain open until September 30, after which balances will need to be claimed via the Ethereum mainnet contract.
A cautionary tale for DeFi
Kinto’s downfall underscores the persistent risks facing DeFi and Layer-2 projects, particularly those relying on upgradeable smart contracts. The exploit has reignited calls for tighter security standards, stronger treasury safeguards, and more sustainable yield models.
In its final statement, the team pledged to exit responsibly:
“We’ll shut down responsibly, return what we can today, and keep fighting for recoveries tomorrow,” Kinto wrote on X.
While the chapter closes on Kinto, its story will likely serve as another cautionary reminder of just how fragile even promising crypto projects can be when security lapses collide with market realities.
