Update on the Kintsu incident
Correct routing for
kintsu.xyz has been restored, and the domain no longer directs visitors to the malicious clone. We’re continuing to monitor it and to investigate the cause with our providers.
From about 00:15 to 04:11 UTC on October 31, an unauthorized nameserver change at our domain registrar (Vercel, which uses Name[dot]com) redirected visitors to a malicious clone of our site. Some networks kept showing the clone until about 05:20 UTC. Our frontend code and smart contracts were not compromised.
We paused sMON deposits and withdrawals at 06:34 UTC on October 31, and they remain paused. This blocks redemption through Kintsu, including an identified pending redemption associated with stolen funds. sMON transfers remain enabled.
We’re leaning toward adding targeted freezing and recovery powers to help address verified theft. These would give Kintsu’s administrators greater authority, including the ability to freeze and reassign funds. That changes the trust users place in us, and we want to be transparent about the trade-offs. Any proposed upgrade will undergo an independent security audit before deployment, and we’ll explain its scope, safeguards and authorization process before it goes live. Recovery is not yet guaranteed.
If you connected a wallet or signed anything on
kintsu.xyz during that window, move your funds to a new wallet. The attack used a wallet “delegation” signature, so revoking token approvals alone is not enough. Then open a ticket in our official Discord with your full wallet address and transaction hashes.
We’re sorry to everyone affected. Kintsu will never DM you first or ask for your seed phrase, private keys, a signature, or a payment.