Audit log

Every state-changing event for AlphaPo: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-19 21:18:06Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 420,849,036

   sig

   2vsEAmwhR2Ku…Q1PQzwbfcopyexplorer ↗

   hash

   67Jtn9mUqBDe…dYMaJxE3copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (7037 B) ▸

   {"actor":"system:backfill","investigation_id":"d4bee666-6fbc-4dfb-a664-5ddafeb35c88","kind":"publish","page_slug":"alphapo","published_at":"2026-05-19T21:18:06.799Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"AlphaPo","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://alphapo.net/"},{"credibility":3,"name":"","type":"other","url":"https://fintelegram.com/coinspaid-crypto-payment-processor-investor-briefing/"},{"credibility":3,"name":"","type":"other","url":"https://stopfrauders.org/unraveling-the-coinspaid-group-and-its-alleged-misconduct-a-closer-look-at-coinspaid-and-alphapo/"},{"credibility":3,"name":"","type":"other","url":"https://www.casino.org/news/gaming-operators-suffer-in-31m-hack-of-cryptocurrency-payments-platform/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/alphapo-payment-provider-hack-estimated-over-60m-on-chain-sleuth"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/alphapo-hot-wallets-hacked-for-over-31-million"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-alphapo-hack-july-2023"},{"credibility":3,"name":"","type":"other","url":"https://www.bleepingcomputer.com/news/security/lazarus-hackers-linked-to-60-million-alphapo-cryptocurrency-heist/"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/241048/alphapo-hot-wallets-drained-for-23-million-hypedrop-disables-withdrawals"},{"credibility":3,"name":"","type":"other","url":"https://www.trmlabs.com/resources/blog/us-treasury-sanctions-north-koreas-preferred-mixer-sinbad"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.fbi.gov/news/press-releases/fbi-identifies-cryptocurrency-funds-stolen-by-dprk"},{"credibility":3,"name":"","type":"other","url":"https://therecord.media/north-korea-lazarus-behind-crypto-heists"},{"credibility":3,"name":"","type":"other","url":"https://decrypt.co/150282/north-korean-hacker-cell-lazarus-allegedly-behind-60m-alphapo-hack"},{"credibility":3,"name":"","type":"other","url":"https://techcrunch.com/2023/08/23/fbi-north-korea-lazarus-crypto/"},{"credibility":3,"name":"","type":"other","url":"https://www.cpomagazine.com/cyber-security/crypto-sleuth-attributes-the-alphopo-crypto-theft-to-north-korean-hackers-raises-the-amount-stolen-to-60-million/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.merklescience.com/blog/hack-track-alphapo-flow-of-funds-analysis"},{"credibility":3,"name":"","type":"other","url":"https://www.trmlabs.com/resources/blog/us-treasury-sanctions-north-koreas-preferred-mixer-sinbad"},{"credibility":3,"name":"","type":"other","url":"https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/alphapo_coinspaid.md"},{"credibility":3,"name":"","type":"other","url":"https://www.elliptic.co/blog/how-the-lazarus-group-is-stepping-up-crypto-hacks-and-changing-its-tactics"},{"credibility":3,"name":"","type":"other","url":"https://www.scorechain.com/blog/alphapo-hack-now-estimated-at-over-60m"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/241048/alphapo-hot-wallets-drained-for-23-million-hypedrop-disables-withdrawals"},{"credibility":3,"name":"","type":"other","url":"https://www.casino.org/news/gaming-operators-suffer-in-31m-hack-of-cryptocurrency-payments-platform/"},{"credibility":3,"name":"","type":"other","url":"https://www.web3isgoinggreat.com/?id=alphapo-hack"},{"credibility":3,"name":"","type":"other","url":"https://beincrypto.com/alphapo-hot-wallet-hack/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.fbi.gov/news/press-releases/fbi-identifies-cryptocurrency-funds-stolen-by-dprk"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-alphapo-hack-july-2023"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/252081/humans-remain-weakest-link-coinspaid-ceo-lazarus-group-hack"},{"credibility":3,"name":"","type":"other","url":"https://stopfrauders.org/unraveling-the-coinspaid-group-and-its-alleged-misconduct-a-closer-look-at-coinspaid-and-alphapo/"}]}],"sources_used":[],"summary":"AlphaPo is a cryptocurrency payment processor incorporated in Panama and operating primarily in the online gambling sector, serving clients such as HypeDrop, Bovada, and Ignition. On July 22, 2023, attackers drained approximately $60 million in ETH, BTC, and TRX from its hot wallets via a private key compromise, disrupting withdrawals across multiple dependent platforms. On-chain investigator ZachXBT and subsequently the FBI attributed the attack to the DPRK-affiliated Lazarus Group (also designated TraderTraitor and APT38), placing the incident within a broader 2023 North Korean cryptocurrency theft campaign that totaled over $200 million.","timeline":[{"date":"2018-01-01","event":"AlphaPo Solution Inc. established as a cryptocurrency payment gateway, incorporated in Panama, serving online gambling and gaming clients.","source":""},{"date":"2023-07-22","event":"Hot wallets across Ethereum, Tron, and Bitcoin networks drained simultaneously via alleged private key compromise; initial on-chain estimates put losses at approximately $23 million.","source":""},{"date":"2023-07-23","event":"HypeDrop publicly reports inability to process BTC, ETH, and TRX deposits and withdrawals, attributing the disruption to its payment provider AlphaPo. The Block reports the connection.","source":""},{"date":"2023-07-25","event":"ZachXBT identifies an additional $37 million in BTC and TRX transactions linked to the attacker, raising the total estimated theft to $60 million and publicly attributes the attack to the Lazarus Group.","source":""},{"date":"2023-07-26","event":"BleepingComputer and Decrypt publish analyses of the hack; Halborn security firm publishes technical breakdown citing private key compromise as root cause.","source":""},{"date":"2023-08-22","event":"FBI issues official press release attributing the AlphaPo theft to DPRK TraderTraitor-affiliated actors (Lazarus Group / APT38), citing the incident as part of a 2023 campaign exceeding $200 million in stolen cryptocurrency.","source":""},{"date":"2023-08-23","event":"FBI warns cryptocurrency exchanges that DPRK may attempt to liquidate approximately 1,580 Bitcoin linked to the combined AlphaPo, CoinsPaid, and Atomic Wallet thefts.","source":""},{"date":"2023-11-29","event":"U.S. Treasury OFAC sanctions Sinbad cryptocurrency mixer, the service used to launder AlphaPo proceeds, specifically citing its role in laundering Lazarus Group hack proceeds.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision f93d9042-ae61-4106-8f52-d0fb0e62f0cecopy
2. #2rescoreby systemsystem

   2026-10-10 18:49:27Z
   Score: 10 → 58 (+48)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 58. Problems weighed by who is responsible: incidents the subject suffered −12.8, concerns that are not fraud −3.2, problems around the subject, caused by others −0.8; legitimacy credit long-running +10.
   anchoranchored

   chain

   ●mainnet-betaslot 455,369,536

   sig

   4kHENhmK318j…dYhxMe3Ecopyexplorer ↗

   hash

   J6b5G8WNhUZg…qrDyLRikcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (640 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:49:27.479Z","decision":"rescore","investigation_id":"d4bee666-6fbc-4dfb-a664-5ddafeb35c88","new_score":58,"page_slug":"alphapo","prev_score":10,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 58. Problems weighed by who is responsible: incidents the subject suffered −12.8, concerns that are not fraud −3.2, problems around the subject, caused by others −0.8; legitimacy credit long-running +10.","score_delta":48,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision c32b090f-ab4f-4086-90a0-856411d2283ecopy
3. #3reviewby reviewerreviewer

   2026-11-01 23:20:55Z
   Score: 58 → 58 (no score change)
   Core facts check out: the July 2023 hack, the $23M to $60M estimate, ZachXBT's Lazarus attribution, the FBI release of Aug 22 2023 and the Nov 29 2023 Sinbad sanction. Minor issues: the 1,580 BTC warning is dated Aug 23 but appears to belong to the Aug 22 release; the Curacao claim is not on the homepage; the multisig and no-audit statements are inference or absence claims. Several sources were not read (fbi.gov blocked, Merkle Science and others not fetched), so the sample is small.
   anchoranchored

   chain

   ●mainnet-betaslot 464,274,905

   sig

   5JJrmvzjntJw…jrhHLNbicopyexplorer ↗

   hash

   BEcrVw3veLNn…ozKe54Ykcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1334 B) ▸

   {"actor":"reviewer","artifact_identity":"f67fc4c0090fcc38df057d531291183c","blocked_count":1,"decided_at":"2026-11-01T23:20:55.283Z","decision":"review","disputed_pct":0.1429,"findings_hash":"7SpaCFgpdekcSroRDskZHoXycHe6wikfGyyHHMEJqwxU","investigation_id":"d4bee666-6fbc-4dfb-a664-5ddafeb35c88","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":58,"page_content_hash":"ad8c32ad33d8ec73fbc91d49c35c9cfe7f25c319eabcd0bb614970b805be2bc3","page_slug":"alphapo","prev_score":58,"reason":"Core facts check out: the July 2023 hack, the $23M to $60M estimate, ZachXBT's Lazarus attribution, the FBI release of Aug 22 2023 and the Nov 29 2023 Sinbad sanction. Minor issues: the 1,580 BTC warning is dated Aug 23 but appears to belong to the Aug 22 release; the Curacao claim is not on the homepage; the multisig and no-audit statements are inference or absence claims. Several sources were not read (fbi.gov blocked, Merkle Science and others not fetched), so the sample is small.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":7,"sequence_num":3,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 30f8f29b-59e7-4c2e-8411-d4d8e781bbe3copy
4. #4review reviseby judgejudge

   2026-11-01 23:20:55Z
   Score: 58 → 58 (no score change)
   The core facts hold up: the July 2023 hack, the $23M to $60M loss estimate, ZachXBT's Lazarus attribution, the FBI release of 22 August 2023 and the 29 November 2023 Sinbad sanction were confirmed or substantially supported (claim_findings[0], [2], [3], [4]). One of seven scored claims could not be verified: the statement that AlphaPo published no post-incident audit, which also carries an unsupported 'without multi-signature controls' inference (claim_findings[6]). That puts the page in the 10-30% band. Smaller issues are a timeline entry dated 23 August that appears to belong to the 22 August FBI release (claim_findings[1]), a Curacao self-description not found on the company homepage (claim_findings[5]), and an OFAC link to AlphaPo that rests on analyst reporting rather than OFAC itself (claim_findings[0]). One finding was excluded because its source (Merkle Science) was blocked, and no omissions or status contradictions were reported. The penalty is kept at the mild end because reviewer confidence is only 0.5 and no claim was found false.
   anchoranchored

   chain

   ●mainnet-betaslot 464,274,910

   sig

   24BGSZcdTana…KbaMjGqWcopyexplorer ↗

   hash

   5UHqGByB4qq7…81r8SwXycopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1735 B) ▸

   {"actor":"judge","artifact_identity":"f67fc4c0090fcc38df057d531291183c","band_override":null,"blocked_count":1,"decided_at":"2026-11-01T23:20:55.283Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.1429,"investigation_id":"d4bee666-6fbc-4dfb-a664-5ddafeb35c88","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":58,"page_slug":"alphapo","prev_score":58,"reason":"The core facts hold up: the July 2023 hack, the $23M to $60M loss estimate, ZachXBT's Lazarus attribution, the FBI release of 22 August 2023 and the 29 November 2023 Sinbad sanction were confirmed or substantially supported (claim_findings[0], [2], [3], [4]). One of seven scored claims could not be verified: the statement that AlphaPo published no post-incident audit, which also carries an unsupported 'without multi-signature controls' inference (claim_findings[6]). That puts the page in the 10-30% band. Smaller issues are a timeline entry dated 23 August that appears to belong to the 22 August FBI release (claim_findings[1]), a Curacao self-description not found on the company homepage (claim_findings[5]), and an OFAC link to AlphaPo that rests on analyst reporting rather than OFAC itself (claim_findings[0]). One finding was excluded because its source (Merkle Science) was blocked, and no omissions or status contradictions were reported. The penalty is kept at the mild end because reviewer confidence is only 0.5 and no claim was found false.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":7,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 58b6ab52-605c-469f-9218-03ca8ea17213copy
5. #5rescoreby systemsystem

   2026-11-01 23:20:56Z
   Score: 58 → 65 (+7)
   Recalculated after the fact-check of 2026-11-01. Rescored under Scoring v2, the published formula (avoid.net/scoring): 58 → 65. Problems weighed by who is responsible: incidents the subject suffered −9.6, problems around the subject, caused by others −0.8; legitimacy credit long-running +10; 2 section(s) set aside until a failed fact-check is resolved.
   anchoranchored

   chain

   ●mainnet-betaslot 464,274,915

   sig

   Q8UpwkipSEyB…nVaUBdoscopyexplorer ↗

   hash

   Bh5KzjSPJXsx…H5SG4NoAcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (715 B) ▸

   {"actor":"system","decided_at":"2026-11-01T23:20:55.283Z","decision":"rescore","investigation_id":"d4bee666-6fbc-4dfb-a664-5ddafeb35c88","new_score":65,"page_slug":"alphapo","prev_score":58,"reason":"Recalculated after the fact-check of 2026-11-01. Rescored under Scoring v2, the published formula (avoid.net/scoring): 58 → 65. Problems weighed by who is responsible: incidents the subject suffered −9.6, problems around the subject, caused by others −0.8; legitimacy credit long-running +10; 2 section(s) set aside until a failed fact-check is resolved.","score_delta":7,"score_model":"v2","sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision e869d935-cb95-4499-b88b-a169f0859796copy