Audit log

Every state-changing event for 8ightDAO: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-28 17:44:18Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,768,090

   sig

   Sic97HaxkxWg…pQSDTYqWcopyexplorer ↗

   hash

   71xEs8w35Awu…ZdM9xTMScopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (9972 B) ▸

   {"actor":"system:backfill","investigation_id":"cb6dbc1b-c466-4a62-b24b-9e33ac816240","kind":"publish","page_slug":"8ightdao","published_at":"2026-05-28T17:44:18.579Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"8ightDAO","sections":[{"content":"8ight Finance launched on the Harmony (ONE) blockchain around October 26, 2021, operating as a fork of OlympusDAO (OHM). The project marketed itself as a corrective alternative following the Snowdog DAO rug pull, which had left many investors with significant losses. The native token was EIGHT. The team operated under pseudonyms, with at least one member identified as @s7ven_8ight on social media. The team was anonymous and this was described as their first project.","heading":"Background and Launch","severity":"medium","sources":[{"credibility":2,"name":"8ight Finance Admits 'Opsec Was Low' After Treasury Compromised","type":"news_article","url":"https://fullycrypto.com/8ight-finance-admits-opsec-was-low-after-treasury-compromised"},{"credibility":3,"name":"8ight Finance (@8ight_finance) Twitter profile","type":"social_media","url":"https://www.twuzy.com/profile/8ight_finance"}]},{"content":"On December 6, 2021, 8ight Finance's entire treasury was drained. The stolen funds totaled approximately $1.75 million in stablecoins, including roughly 490,170 DAI, 378,417 DAI with 10,843 LP tokens, and 12,362 USDT, with an additional 868,587 DAI transferred between accounts. The team announced on Discord that the private key controlling the treasury had been compromised. According to the team's own statement: 'Two devs in the team has the key, they were sent through Facebook groups chat and Google Drive.' All funds were subsequently routed through Tornado Cash on Ethereum, rendering them effectively untraceable. The EIGHT token lost over 75% of its value within 24 hours of the announcement and was down approximately 98% from its all-time high.","heading":"Treasury Drain — December 2021","severity":"critical","sources":[{"credibility":2,"name":"8ight Finance completely drained after private key leak — Web3 Is Going Great","type":"news_article","url":"https://www.web3isgoinggreat.com/?id=2021-12-06-1"},{"credibility":2,"name":"8ight Finance Hacked: All Funds in Treasury Withdrawn due to Leak of the Private Key — CoinCodeCap","type":"news_article","url":"https://coincodecap.com/8ight-finance-hacked-all-funds-in-treasury-withdrawn-due-to-leak-of-the-private-key"},{"credibility":2,"name":"8ight Finance — REKT","type":"research","url":"https://rekt.news/8ight-finance-rekt"}]},{"content":"The circumstances of the treasury drain generated immediate community suspicion. Despite the team's explanation of an external compromise, several indicators drew scrutiny. First, the project had falsely assured investors that a multi-signature wallet was in place when it was not — rekt.news described this as 'the most basic of errors.' Second, the decision to route all funds directly to Tornado Cash precluded any recovery or on-chain attribution. Third, some community members alleged the developer pocketed the funds themselves, with at least one Discord member stating 'Compromised my ass… the team has rugged funds.' The team's framing as helpers of Snowdog DAO victims, while itself then allegedly losing investor funds under opaque circumstances, was noted as a pattern consistent with serial fraud in the DeFi space. rekt.news stated: 'If this was a planned event, then it's likely that the developers have a history.' No definitive proof of intentional fraud was established given Tornado Cash obfuscation. ZachXBT has flagged this entity, though the specific nature and content of that flagging was not independently located in public records during this investigation.","heading":"Rug Pull Allegations vs. Hack Narrative","severity":"high","sources":[{"credibility":2,"name":"8ight Finance — REKT","type":"research","url":"https://rekt.news/8ight-finance-rekt"},{"credibility":2,"name":"8ight Finance Admits 'Opsec Was Low' After Treasury Compromised — Fully Crypto","type":"news_article","url":"https://fullycrypto.com/8ight-finance-admits-opsec-was-low-after-treasury-compromised"},{"credibility":2,"name":"8ight Finance completely drained after private key leak — Web3 Is Going Great","type":"news_article","url":"https://www.web3isgoinggreat.com/?id=2021-12-06-1"}]},{"content":"8ight Finance's team publicly stated that a multi-signature wallet arrangement was in place to protect treasury funds. Post-incident reporting confirmed that no multi-sig was actually implemented. This misrepresentation — regardless of whether the subsequent drain was an external hack or an inside job — constitutes a material false statement to investors. The private key was held by two developers and transmitted over Facebook group chat and Google Drive, both of which lack basic encryption appropriate for cryptographic secrets.","heading":"Broken Security Promises","severity":"high","sources":[{"credibility":2,"name":"8ight Finance — REKT","type":"research","url":"https://rekt.news/8ight-finance-rekt"},{"credibility":2,"name":"8ight Finance Hacked: All Funds in Treasury Withdrawn due to Leak of the Private Key — CoinCodeCap","type":"news_article","url":"https://coincodecap.com/8ight-finance-hacked-all-funds-in-treasury-withdrawn-due-to-leak-of-the-private-key"}]},{"content":"Following the treasury drain, the team proposed a recovery plan offering two options to the community: constructing a new protocol on Avalanche (AVAX) with liquidity borrowing functionality and airdropping tokens to EIGHT holders, or distributing $250,000 in remaining marketing funds proportionally to affected users. The team announced the project was 'not safe to use anymore' and instructed investors to stop buying EIGHT tokens. There is no evidence of successful restitution to investors.","heading":"Recovery Plan and Aftermath","severity":"medium","sources":[{"credibility":2,"name":"8ight Finance Admits 'Opsec Was Low' After Treasury Compromised — Fully Crypto","type":"news_article","url":"https://fullycrypto.com/8ight-finance-admits-opsec-was-low-after-treasury-compromised"},{"credibility":2,"name":"8ight Finance Hacked: All Funds in Treasury Withdrawn due to Leak of the Private Key — CoinCodeCap","type":"news_article","url":"https://coincodecap.com/8ight-finance-hacked-all-funds-in-treasury-withdrawn-due-to-leak-of-the-private-key"}]},{"content":"The drained funds were transferred from the 8ight Finance treasury to an intermediate Ethereum address before being routed into Tornado Cash. A community member identified the intermediate address, though further tracing was blocked by the mixer. The use of Tornado Cash as the immediate destination is a common obfuscation technique associated with intentional fund theft. No smart contract vulnerability was identified as the attack vector; the sole documented entry point was possession of the private key.","heading":"On-Chain Indicators","severity":"high","sources":[{"credibility":2,"name":"8ight Finance completely drained after private key leak — Web3 Is Going Great","type":"on_chain","url":"https://www.web3isgoinggreat.com/?id=2021-12-06-1"},{"credibility":2,"name":"8ight Finance — REKT","type":"research","url":"https://rekt.news/8ight-finance-rekt"}]}],"sources_used":[{"credibility":2,"name":"8ight Finance completely drained after private key leak — Web3 Is Going Great","type":"news_article","url":"https://www.web3isgoinggreat.com/?id=2021-12-06-1"},{"credibility":2,"name":"8ight Finance Hacked: All Funds in Treasury Withdrawn due to Leak of the Private Key — CoinCodeCap","type":"news_article","url":"https://coincodecap.com/8ight-finance-hacked-all-funds-in-treasury-withdrawn-due-to-leak-of-the-private-key"},{"credibility":2,"name":"8ight Finance Admits 'Opsec Was Low' After Treasury Compromised — Fully Crypto","type":"news_article","url":"https://fullycrypto.com/8ight-finance-admits-opsec-was-low-after-treasury-compromised"},{"credibility":2,"name":"8ight Finance — REKT","type":"research","url":"https://rekt.news/8ight-finance-rekt"},{"credibility":3,"name":"8ight Finance (@8ight_finance) Twitter profile archive — Twuzy","type":"social_media","url":"https://www.twuzy.com/profile/8ight_finance"}],"summary":"8ight Finance (also referred to as 8ightDAO) was an OHM fork launched on the Harmony blockchain in October 2021, positioning itself as a relief project for victims of the Snowdog DAO rug pull. In December 2021, approximately $1.75 million in treasury stablecoins was drained after the team admitted to transmitting private keys through Facebook group chat and Google Drive. The incident is disputed: community members alleged an intentional rug pull while the team claimed external compromise, but funds were sent to Tornado Cash making attribution impossible.","timeline":[{"date":"2021-10-26","event":"8ight Finance Twitter account created, indicating approximate project launch on Harmony blockchain.","source":"8ight Finance Twitter profile archive","source_url":"https://www.twuzy.com/profile/8ight_finance"},{"date":"2021-12-06","event":"Treasury drain announced. Approximately $1.75 million in stablecoins stolen via compromised private key. Team admits key was shared via Facebook chat and Google Drive. Funds routed to Tornado Cash.","source":"Web3 Is Going Great","source_url":"https://www.web3isgoinggreat.com/?id=2021-12-06-1"},{"date":"2021-12-07","event":"Team proposes two-option recovery plan: rebuild on AVAX with airdrop, or distribute $250,000 marketing funds to holders.","source":"CoinCodeCap","source_url":"https://coincodecap.com/8ight-finance-hacked-all-funds-in-treasury-withdrawn-due-to-leak-of-the-private-key"},{"date":"2021-12-08","event":"rekt.news publishes full post-mortem, noting the absence of promised multi-sig, raising the possibility of intentional insider theft.","source":"rekt.news","source_url":"https://rekt.news/8ight-finance-rekt"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d04cd0de-41c7-4e2c-85c8-424fdbfaf235copy
2. #2reviewby reviewerreviewer

   2026-10-28 00:50:57Z
   Score: 18 → 18 (no score change)
   The core incident (Dec 2021 loss of about $1.75M, key shared via Facebook/Google Drive, missing multisig, Tornado Cash, two-option recovery plan) is well supported by rekt.news and CoinCodeCap. Unsupported or weakly supported: launch details and the Snowdog link, price-drop figures, the ZachXBT mention, the intermediate-address claim, and the 'serial fraud pattern' framing. The fullycrypto.com citation is dead (404), which leaves several claims without a readable source.
   anchoranchored

   chain

   ●mainnet-betaslot 462,279,898

   sig

   3qNpBXsxNyFK…in19bumtcopyexplorer ↗

   hash

   5q3LmMKperWv…8SVa2LvEcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1357 B) ▸

   {"actor":"reviewer","artifact_identity":"47215cdeb726477dc11cf15b82198155","blocked_count":1,"decided_at":"2026-10-28T00:50:57.917Z","decision":"review","disputed_pct":0.3,"findings_hash":"AhaGxaHhZe1VmVg8oCaePBEFvFQYLhNTqXCGvhFMrN2n","investigation_id":"cb6dbc1b-c466-4a62-b24b-9e33ac816240","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":18,"omissions":{"material":0,"total":1},"page_content_hash":"2bda9cc3fa34240f93af8223f6c30e1867b9d517f0a32677e843237534d06e35","page_slug":"8ightdao","prev_score":18,"reason":"The core incident (Dec 2021 loss of about $1.75M, key shared via Facebook/Google Drive, missing multisig, Tornado Cash, two-option recovery plan) is well supported by rekt.news and CoinCodeCap. Unsupported or weakly supported: launch details and the Snowdog link, price-drop figures, the ZachXBT mention, the intermediate-address claim, and the 'serial fraud pattern' framing. The fullycrypto.com citation is dead (404), which leaves several claims without a readable source.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":10,"sequence_num":2,"subject_status":"shut_down","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 70b0a532-0610-4012-9cda-8d4ee2dd967fcopy
3. #3review reviseby judgejudge

   2026-10-28 00:50:58Z
   Score: 18 → 3 (-15)
   The core incident is well supported: the roughly $1.75M treasury loss, the keys shared over Facebook and Google Drive, the missing multisig, and the two-option recovery plan are confirmed by rekt.news and CoinCodeCap (claim_findings[0], [1], [5], [8], [9]). Of 10 countable findings (one blocked-source finding excluded), 3 are unverifiable (launch and Snowdog framing with a dead fullycrypto.com citation, the ZachXBT mention, the intermediate-address claim), giving 30%, the top of the minor band. Two further claims overstate their sources: the 'serial fraud pattern' framing turns rekt.news's conditional speculation into a noted pattern (claim_findings[7]), and the Tornado Cash 'all funds' and chain detail is only partly confirmed (claim_findings[2]). The price-drop figures could not be checked because the source was blocked, which is a coverage limit rather than a defect. The only omission is minor and the page's past tense is consistent with the project being deprecated, so the penalty sits at the upper end of the minor band without moving to the significant band.
   anchoranchored

   chain

   ●mainnet-betaslot 462,279,903

   sig

   5jscnbeGAgae…WitTm8gScopyexplorer ↗

   hash

   DTbeK95dgvoN…ExW3BZuHcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1756 B) ▸

   {"actor":"judge","artifact_identity":"47215cdeb726477dc11cf15b82198155","band_override":null,"blocked_count":1,"decided_at":"2026-10-28T00:50:57.917Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.3,"investigation_id":"cb6dbc1b-c466-4a62-b24b-9e33ac816240","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":3,"page_slug":"8ightdao","prev_score":18,"reason":"The core incident is well supported: the roughly $1.75M treasury loss, the keys shared over Facebook and Google Drive, the missing multisig, and the two-option recovery plan are confirmed by rekt.news and CoinCodeCap (claim_findings[0], [1], [5], [8], [9]). Of 10 countable findings (one blocked-source finding excluded), 3 are unverifiable (launch and Snowdog framing with a dead fullycrypto.com citation, the ZachXBT mention, the intermediate-address claim), giving 30%, the top of the minor band. Two further claims overstate their sources: the 'serial fraud pattern' framing turns rekt.news's conditional speculation into a noted pattern (claim_findings[7]), and the Tornado Cash 'all funds' and chain detail is only partly confirmed (claim_findings[2]). The price-drop figures could not be checked because the source was blocked, which is a coverage limit rather than a defect. The only omission is minor and the page's past tense is consistent with the project being deprecated, so the penalty sits at the upper end of the minor band without moving to the significant band.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":-15,"scored_claims":10,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 13273738-3a82-4fc1-9c86-f84f2717abe4copy