INKFinance exploit analysis
INKFinance's lending pool priced collateral against a manipulable oracle, so a flash-loan-driven price drop let the attacker borrow against the inflated collateral. DeFiHackLabs reconstructs about $140K drained on Polygon.
- Reported loss
- ~$140K, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-05-11: Business Logic Flaw on INKFinance”.
Analysis1 min read
INKFinance's lending pool accepted an interest accrual rate that was set against a manipulated price oracle. The attacker flash-loaned the price oracle's underlying token, dropped the price, then borrowed against the inflated collateral position.
DeFiHackLabs reconstructs the sequence against the live Polygon state; the drain is in 0xb469a24ec737be16fe41367a7b5b315c7f03b4e0ff3af50b3a2db03b3066b982 on Polygonscan for a total loss of about $140K.
What would have prevented it: a price oracle with a TWAP guard, or any lending position that is bounded by a per-block borrow cap that is not affected by oracle volatility.
Sources read (3)
- https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/README.md#20260511-inkfinance---lending-pool-price-oracle-manipulation
- https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-05/INKFinance_exp.sol
- https://polygonscan.com/tx/0xb469a24ec737be16fe41367a7b5b315c7f03b4e0ff3af50b3a2db03b3066b982
Other exploits
- AdsharesBridge exploit analysis 15 May 2026
- SQTokenStaking exploit analysis 12 May 2026
- HumaFinance exploit analysis 11 May 2026
- Renegade exploit analysis 10 May 2026
- TrustedVolumes exploit analysis 7 May 2026
- Ekubo exploit analysis 5 May 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
