Audit log

Every state-changing event for Abracadabra Spell: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-19 20:04:13Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 420,837,902

   sig

   4sk2Bm5tZQeh…ExuqE35Ncopyexplorer ↗

   hash

   FyxrBeqSBLSF…Fxv2q45rcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6801 B) ▸

   {"actor":"system:backfill","investigation_id":"e44dde56-bba7-433f-98f5-e5d42700a900","kind":"publish","page_slug":"abracadabra-spell","published_at":"2026-05-19T20:04:13.220Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Abracadabra Spell","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.gemini.com/cryptopedia/abracadabra-money-spell-token-abracadabra-crypto-lending"},{"credibility":3,"name":"","type":"other","url":"https://defillama.com/protocol/abracadabra"},{"credibility":3,"name":"","type":"other","url":"https://cryptoticker.io/en/rise-and-fall-spell-token/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://rekt.news/sifu-scandal"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/tech/2022/01/27/how-did-a-former-quadriga-exec-end-up-running-a-defi-protocol-wonderland-founder-explains"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/132340/wonderland-votes-out-quadrigacx-co-founder-sifu-and-is-considering-shutting-down"},{"credibility":3,"name":"","type":"other","url":"https://decrypt.co/91968/how-wonderland-daniele-sestagalli-defi-avoided-shutting-down-after-michael-patryn-scandal"},{"credibility":3,"name":"","type":"other","url":"https://www.vice.com/en/article/crypto-co-founder-revealed-to-be-infamous-fraudster-investors-shaken/"},{"credibility":3,"name":"","type":"other","url":"http://www.quadrigainitiative.com/casestudy/wonderlandmoneysifuscandal.php"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://pontem.network/posts/wonderland-time-and-mim-scandal-what-you-need-to-know"},{"credibility":3,"name":"","type":"other","url":"https://www.investing.com/analysis/can-terras-ust-stablecoin-hold-its-peg-200617570"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-abracadabra-money-hack-march-2025"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-abracadabra-hack-october-2025"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/348059/hacker-steals-13-million-in-abracadabras-magic-internet-money-seemingly-using-a-flash-loan-attack"},{"credibility":3,"name":"","type":"other","url":"https://www.observers.com/6-5m-abracadabra-exploit-led-to-magic-internet-money-stablecoin-depeg/"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/abracadabra-s-6-49m-loss-leads-to-mim-stablecoin-destabilization"},{"credibility":3,"name":"","type":"other","url":"https://threesigma.xyz/blog/exploit/mimspell-abracadabra-hack-breakdown"},{"credibility":3,"name":"","type":"other","url":"https://blockworks.com/news/rounding-exploit-magic-internet-money"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://marketrealist.com/p/abracadabra-money-founder-net-worth/"},{"credibility":3,"name":"","type":"other","url":"https://cryptobriefing.com/who-is-daniele-sestagalli/"},{"credibility":3,"name":"","type":"other","url":"https://rekt.news/sifu-scandal"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.cftc.gov/LawRegulation/EnforcementActions/index.htm"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/373453/abracadabra-loses-1-8-million-in-protocols-third-major-defi-hack-since-2024"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-abracadabra-money-hack-march-2025"},{"credibility":3,"name":"","type":"other","url":"https://www.investingcube.com/spell-token-price-prediction-abracadabras-fall-from-grace-cryptocurrencies/"}]}],"sources_used":[],"summary":"Abracadabra.money is a multi-chain DeFi lending protocol that allows users to mint the MIM (Magic Internet Money) USD-pegged stablecoin using interest-bearing tokens as collateral. The protocol has been compromised three times since January 2024, losing a combined total of over $21 million, and its founding ecosystem was shaken in January 2022 when co-founder Daniele Sestagalli's associate — Wonderland's pseudonymous treasury manager known as 0xSifu — was publicly identified as Michael Patryn, a convicted felon and co-founder of the fraudulent exchange QuadrigaCX. The SPELL token has declined approximately 99.5% from its November 2021 all-time high, and the protocol's total value locked has collapsed from over $776 million to under $30 million.","timeline":[{"date":"2021-11-01","event":"Abracadabra.money launches; SPELL token reaches all-time high of approximately $0.035.","source":""},{"date":"2022-01-15","event":"Wonderland (Frog Nation) records near all-time high TVL of approximately $776 million.","source":""},{"date":"2022-01-27","event":"ZachXBT publicly reveals that 0xSifu, Wonderland's pseudonymous CFO/treasury manager, is Michael Patryn — convicted felon and QuadrigaCX co-founder. Daniele Sestagalli admits he knew Patryn's real identity for approximately one month prior to the disclosure.","source":""},{"date":"2022-01-29","event":"Wonderland DAO votes 88% in favor of removing Sifu as treasury manager; a second vote elects to continue protocol operations rather than unwind.","source":""},{"date":"2022-01-27","event":"SPELL, TIME, and ICE tokens crash on news of the Sifu scandal; approximately $130 million in MIM is dumped by a single wallet within days.","source":""},{"date":"2022-05-01","event":"Terra/LUNA ecosystem collapses. Abracadabra's Degenbox strategy — which created recursive MIM-UST leverage loops — suffers significant contagion losses. MIM experiences depeg pressure.","source":""},{"date":"2024-01-30","event":"First major exploit: rounding precision bug in Cauldron V3/V4 contracts allows attacker to drain approximately $6.5 million in ETH and MIM. MIM briefly depegs to $0.76.","source":""},{"date":"2025-03-01","event":"Second major exploit: attacker drains approximately $13 million (6,262 ETH) via state-tracking flaw in GMX V2 Cauldron integration using a multi-step self-liquidation attack.","source":""},{"date":"2025-10-04","event":"Third major exploit: logic error in deprecated PrivilegedCauldronV4 cook() function allows attacker to bypass solvency checks and steal approximately 1,793,766 MIM and 395 ETH (~$1.8 million). Funds laundered via Tornado Cash. PeckShield subsequently alleged to have missed the vulnerability in a prior audit.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision f5569bf7-9344-4c43-8398-03304b2f8ec3copy
2. #2rescoreby systemsystem

   2026-10-10 18:49:31Z
   Score: 10 → 53 (+43)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 53. Problems weighed by who is responsible: concerns that are not fraud −12.8, incidents the subject suffered −3.2, problems around the subject, caused by others −1.6; legitimacy credit long-running +6.
   anchoranchored

   chain

   ●mainnet-betaslot 455,369,555

   sig

   4kcaMvvnqKkN…atU9QDzzcopyexplorer ↗

   hash

   4zp692dwr384…pTDkbXbwcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (649 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:49:31.299Z","decision":"rescore","investigation_id":"e44dde56-bba7-433f-98f5-e5d42700a900","new_score":53,"page_slug":"abracadabra-spell","prev_score":10,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 53. Problems weighed by who is responsible: concerns that are not fraud −12.8, incidents the subject suffered −3.2, problems around the subject, caused by others −1.6; legitimacy credit long-running +6.","score_delta":43,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision df01f2ed-54d4-463b-9fda-be65aa9d11a5copy
3. #3reviewby reviewerreviewer

   2026-11-02 04:52:51Z
   Score: 53 → 53 (no score change)
   The three-exploit narrative and the roughly $21M loss total match The Block's tally. The page has a clear TVL peak error: $776M versus about $6.4B on DeFi Llama. It also presents an unverified PeckShield allegation as an implication of fact. Most seriously, it omits the September 2026 wind-down proposal and the MIM depeg since June 2026, so the protocol reads as operating when sources indicate it is being shut down.
   anchoranchored

   chain

   ●mainnet-betaslot 464,367,816

   sig

   5tmsCfcdieow…eitAw5Hwcopyexplorer ↗

   hash

   BPZt7DbggjTv…gpKNofqFcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1309 B) ▸

   {"actor":"reviewer","artifact_identity":"0f5e49e12107300a21992f2f4ced0364","blocked_count":1,"decided_at":"2026-11-02T04:52:51.734Z","decision":"review","disputed_pct":0.4,"findings_hash":"D2hfJqAnnmJFbo8yuywPgTwCsbjytMsGPp9QQ1hkDDbL","investigation_id":"e44dde56-bba7-433f-98f5-e5d42700a900","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":53,"omissions":{"material":3,"total":3},"page_content_hash":"ad4947979117c249a89b6212d789c9b67ca4376340e0e5fb1a99b4dfe156a366","page_slug":"abracadabra-spell","prev_score":53,"reason":"The three-exploit narrative and the roughly $21M loss total match The Block's tally. The page has a clear TVL peak error: $776M versus about $6.4B on DeFi Llama. It also presents an unverified PeckShield allegation as an implication of fact. Most seriously, it omits the September 2026 wind-down proposal and the MIM depeg since June 2026, so the protocol reads as operating when sources indicate it is being shut down.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":10,"sequence_num":3,"subject_status":"shut_down","subject_status_contradicts_page":true,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 255da27c-5943-4d5f-b05d-ff2b1007b38dcopy
4. #4review reviseby judgejudge

   2026-11-02 04:52:51Z
   Score: 53 → 53 (no score change)
   About 40% of checkable claims were disputed or unverifiable (4 of 10, excluding one blocked source). The headline TVL peak of $776 million is disputed (claim_findings[1], [2]) because DeFi Llama via Capital.com gives about $6.4 billion, and the $776 million Wonderland timeline figure has no source (claim_findings[3]). The page also hardens an unverified PeckShield allegation into implied fact (claim_findings[4], [5]) and presents the protocol as operating, while the review found a September 2026 wind-down proposal and a MIM depeg since June 2026 that the page omits (subject_status, omission_findings[0]). The three-exploit tally of over $21 million and the Tornado Cash detail were confirmed (claim_findings[0], [6]), so the page is revised and put under investigation rather than denied.
   anchoranchored

   chain

   ●mainnet-betaslot 464,367,822

   sig

   3XpEuScEjiyu…cEwBXSHHcopyexplorer ↗

   hash

   BekZx1rr46UA…nm46MFuScopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1966 B) ▸

   {"actor":"judge","artifact_identity":"0f5e49e12107300a21992f2f4ced0364","band_override":null,"blocked_count":1,"decided_at":"2026-11-02T04:52:51.734Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.4,"investigation_id":"e44dde56-bba7-433f-98f5-e5d42700a900","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":53,"page_slug":"abracadabra-spell","prev_score":53,"reason":"About 40% of checkable claims were disputed or unverifiable (4 of 10, excluding one blocked source). The headline TVL peak of $776 million is disputed (claim_findings[1], [2]) because DeFi Llama via Capital.com gives about $6.4 billion, and the $776 million Wonderland timeline figure has no source (claim_findings[3]). The page also hardens an unverified PeckShield allegation into implied fact (claim_findings[4], [5]) and presents the protocol as operating, while the review found a September 2026 wind-down proposal and a MIM depeg since June 2026 that the page omits (subject_status, omission_findings[0]). The three-exploit tally of over $21 million and the Tornado Cash detail were confirmed (claim_findings[0], [6]), so the page is revised and put under investigation rather than denied.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":10,"sequence_num":4,"severity_override":{"applied":true,"band":"significant","from_band":"significant","reason":"The review reports a critical omission and subject_status.contradicts_page=true: a September 2026 DAO proposal to wind down the protocol and MIM, with MIM depegged since June 2026, is not mentioned and the page describes the protocol as operating. The percentage band (40%) is already significant, so the band is held at significant and the penalty is set toward the upper end of that band."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 12e35527-5fa8-48d7-8f01-bbb1b32af461copy
5. #5rescoreby systemsystem

   2026-11-02 04:52:53Z
   Score: 53 → 57 (+4)
   Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 53 → 57. Problems weighed by who is responsible: concerns that are not fraud −9.6, incidents the subject suffered −3.2, problems around the subject, caused by others −0.8; legitimacy credit long-running +6; 2 section(s) set aside until a failed fact-check is resolved.
   anchoranchored

   chain

   ●mainnet-betaslot 464,367,827

   sig

   2rYVT7GU15dy…tjuzqA22copyexplorer ↗

   hash

   AqCFAGqnE17b…Mouru1odcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (758 B) ▸

   {"actor":"system","decided_at":"2026-11-02T04:52:51.734Z","decision":"rescore","investigation_id":"e44dde56-bba7-433f-98f5-e5d42700a900","new_score":57,"page_slug":"abracadabra-spell","prev_score":53,"reason":"Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 53 → 57. Problems weighed by who is responsible: concerns that are not fraud −9.6, incidents the subject suffered −3.2, problems around the subject, caused by others −0.8; legitimacy credit long-running +6; 2 section(s) set aside until a failed fact-check is resolved.","score_delta":4,"score_model":"v2","sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ab2c51aa-891d-4af9-b7b0-3e41f107b639copy