Audit log

Every state-changing event for Ambient Finance: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-06-14 23:35:30Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 426,517,219

   sig

   2HzyUWLrz4cN…r68jKzsacopyexplorer ↗

   hash

   7zXQy3NQxxav…RUcj73qbcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (17989 B) ▸

   {"actor":"system:backfill","investigation_id":"15c90e9f-a964-4aa4-8358-196a48fbbd4d","kind":"publish","page_slug":"ambient-finance","published_at":"2026-06-14T23:35:30.779Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Ambient Finance","sections":[{"content":"Ambient Finance was originally founded under the name CrocSwap, later incorporated as Crocodile Labs. The protocol was founded by Douglas Colkitt, who holds a B.S. in Computer Science from the University of Pennsylvania and spent over a decade as a quantitative researcher and high-frequency trader at Citadel Securities before transitioning to DeFi. Colkitt serves as CEO. The protocol's core design runs the entire DEX — all liquidity pools and trading logic — inside a single smart contract rather than the conventional pattern of deploying separate contracts per pool. The project has been active since 2021, with mainnet launch in 2023. Colkitt also served as a founding contributor to the Fogo blockchain, a Firedancer-powered Layer 1.","heading":"Background and Team","severity":"low","sources":[{"credibility":3,"name":"Everything To Know About Douglas Colkitt, The Co-Founder of Ambient Finance","type":"news_article","url":"https://usethebitcoin.com/crypto-personalities/douglas-colkitt-ambient-finance/"},{"credibility":2,"name":"Ambient Finance Overview - Rootdata","type":"research","url":"https://www.rootdata.com/Projects/detail/Ambient%2BFinance?k=Mjk0Ng%3D%3D"},{"credibility":2,"name":"Douglas Colkitt - ETHDenver Speaker Profile","type":"official","url":"https://ethdenver.com/speakers/douglas-colkitt/"}]},{"content":"Ambient Finance raised $6.5 million in a seed round that closed on July 11, 2023, at a reported $80 million network valuation. The round was led by BlockTower Capital and included participation from Jane Street Capital, Circle Ventures, Naval Ravikant (as an angel investor), Tensai Capital, Yunt Capital, Susa Ventures, Quantstamp, and Hypotenuse Labs. The involvement of institutional investors with established track records — particularly Jane Street, a major traditional market-making firm, and Circle, the issuer of USDC — lends the fundraise meaningful credibility. Stated use of funds was team expansion and research and development. The seed round was announced shortly after the protocol's mainnet launch.","heading":"Funding and Investors","severity":"low","sources":[{"credibility":2,"name":"Ambient Finance Raises Seed Round Funding - CrocSwap Medium","type":"official","url":"https://crocswap.medium.com/ambient-finance-raises-seed-round-funding-78328f4fa7e"},{"credibility":2,"name":"Ambient Finance Seed Round - CoinCarp","type":"research","url":"https://www.coincarp.com/fundraising/ambient-finance-seed/"},{"credibility":2,"name":"Ambient Finance - SoSoValue","type":"research","url":"https://sosovalue.com/project/ambient-finance-1844234449004220418"}]},{"content":"Ambient Finance operates a decentralized exchange that combines concentrated and ambient (full-range) constant-product liquidity within a single monolithic smart contract. Individual AMM pools are lightweight data structures within that contract rather than separately deployed contracts. The protocol automatically adjusts pool fees in real time in an attempt to optimize returns for liquidity providers. Ambient is deployed on Ethereum mainnet, Scroll, Blast, and Canto. The protocol launched an XP-based points program coinciding with the Blast mainnet launch in early 2024, which has generated speculation about a potential future token airdrop, though as of June 2026 no token has been officially launched. The single-contract architecture, while efficient, has been cited as a potential concentration of risk.","heading":"Protocol Design and Deployments","severity":"low","sources":[{"credibility":1,"name":"Introduction to Ambient - Ambient Docs","type":"official","url":"https://docs.ambient.finance/"},{"credibility":3,"name":"Ambient Finance Airdrop Guide 2026 - MEXC Blog","type":"news_article","url":"https://blog.mexc.com/ambient-finance-airdrop-guide-2026-how-to-farm-xp-and-position-yourself-before-the-snapshot/"},{"credibility":2,"name":"Potential Ambient Airdrop: Guide On Earning Ambient Points - CoinGecko","type":"news_article","url":"https://www.coingecko.com/learn/potential-ambient-airdrop-earn-ambient-points"}]},{"content":"On October 17, 2024, Ambient Finance's website frontend was compromised via a DNS hijacking attack. Attackers gained unauthorized control of the protocol's domain and redirected users to a malicious clone of the site. Security firm Blockaid identified the malware used as Inferno Drainer, a toolkit specifically designed to steal digital assets by tricking users into approving malicious transactions. The attacker's command-and-control server was reportedly created just 24 hours before the incident. The protocol's core on-chain smart contracts were not affected, and the team stated that funds held in the protocol itself remained safe. Ambient Finance warned users to avoid interacting with the frontend, revoke any contract approvals granted during the attack window, and await an all-clear. The domain was subsequently recovered and transferred to a hardened registrar with DNS security reviewed. The team stated it reimbursed all affected users for their losses, though the total dollar amount lost was not publicly disclosed in reporting reviewed for this investigation. Ambient later confirmed the frontend was safe to use again. The incident is consistent with a class of Web2-layer attacks targeting DeFi frontends where on-chain contracts are bypassed entirely.","heading":"October 2024 Frontend DNS Hijacking","severity":"high","sources":[{"credibility":1,"name":"Ambient Finance website hacked, team warns users to wait for fix - CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/ambient-finance-frontend-hacked-team-warns-users-wait"},{"credibility":2,"name":"Ambient Finance confirms funds are safe - Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/ambient-finance-confirms-funds-are-safe/"},{"credibility":2,"name":"Ambient Finance confirms funds are safe, warns users to avoid frontend post-attack - Mitrade","type":"news_article","url":"https://www.mitrade.com/insights/news/live-news/article-3-420586-20241019"},{"credibility":2,"name":"Circle-backed decentralized exchange Ambient Finance faces front-end hack: Blockaid - Crypto.news","type":"news_article","url":"https://crypto.news/circle-backed-decentralized-exchange-ambient-finance-faces-front-end-hack-blockaid/"},{"credibility":2,"name":"Ambient Finance Frontend DNS Hijacking - Quadriga Initiative","type":"community_report","url":"https://quadrigainitiative.com/cryptocurrencyhackscamfraudwiki/index.php?title=Ambient_Finance_Frontend_DNS_Hijacking"},{"credibility":2,"name":"DeFi Exchange Defeats DNS Attack: Ambient Finance Recovers Domain - CryptoNews","type":"news_article","url":"https://cryptonews.com/news/defi-exchange-defeats-dns-attack-ambient-finance-recovers-domain/"}]},{"content":"On or around June 8, 2026, Ambient Finance suffered an on-chain exploit on Ethereum that resulted in a net loss of approximately $110,600. According to reporting from Crypto Times and disclosures attributed to on-chain security monitor TenArmorAlert, the attacker seeded a newly created smart contract with 50 ETH (approximately $84,000) before executing the exploit, then withdrew approximately 83.72 ETH (approximately $140,700), yielding a net gain of roughly $110,600. Post-exploit, the stolen funds were moved through multiple DeFi protocols: converted to Wrapped Ether, fragmented into smaller transactions, routed through Uniswap V4, and processed through Titan Builder. Specific technical details of the vulnerability have not been publicly disclosed in sources reviewed for this investigation. The single-contract architecture of Ambient was cited by security commentators as a potential factor, as concentrating all pool logic in one contract means a flaw in any component could affect the entire system. At the time of the exploit, Ambient's TVL stood at approximately $1.88 million, a significant decline from a peak range of $120–$130 million in 2024. No official Ambient Finance post-mortem or statement was found in publicly available sources at time of writing.","heading":"June 2026 On-Chain Smart Contract Exploit","severity":"critical","sources":[{"credibility":2,"name":"Ethereum DeFi Protocol Ambient Finance Suffers $110K Drain - Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/06/08/ethereum-defi-protocol-ambient-finance-suffers-110k-drain/"}]},{"content":"Ambient Finance has been associated with Quantstamp, the smart contract security firm, which participated in the protocol's seed round as an investor. However, as of the time of this investigation, CertiK Skynet lists Ambient Finance as 'Not Audited By CertiK,' with no third-party audits listed on that platform. CertiK's Skynet score for the project was 73.77 (BBB rating), with low scores in Fundamental Health (5%) and Operational Resilience (5%), the latter attributed in part to the absence of an active bug bounty program. Team identity was listed as 'Not Verified By CertiK.' The project's GitHub repository showed recent activity as of late April 2026. The absence of a publicly disclosed post-mortem following the June 2026 exploit, and the lack of a confirmed active bug bounty program, represent gaps in the protocol's public security communications.","heading":"Security Posture and Audits","severity":"medium","sources":[{"credibility":2,"name":"Ambient Finance - CertiK Skynet Project Insight","type":"research","url":"https://skynet.certik.com/projects/ambient-finance"},{"credibility":2,"name":"Ambient Finance Overview - SoSoValue","type":"research","url":"https://sosovalue.com/project/ambient-finance-1844234449004220418"}]},{"content":"Ambient Finance's total value locked peaked in a range of approximately $120–$130 million during 2024, when the protocol saw elevated trading activity, particularly following its Blast mainnet deployment and associated points program. By June 2026, reported TVL had declined to approximately $1.88 million, representing a drawdown of over 98% from peak. DefiLlama tracks Ambient Finance's TVL, fees, and revenue metrics in real time. The protocol has processed hundreds of millions of dollars in cumulative trading volume across its supported chains. The substantial TVL decline may reflect broader DeFi market conditions, competition from other DEXs, the security incidents, and the expiration of Blast incentives.","heading":"TVL and Market Activity","severity":"medium","sources":[{"credibility":1,"name":"Ambient TVL, Fees, Revenue, Volume - DefiLlama","type":"on_chain","url":"https://defillama.com/protocol/ambient"},{"credibility":2,"name":"Ethereum DeFi Protocol Ambient Finance Suffers $110K Drain - Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/06/08/ethereum-defi-protocol-ambient-finance-suffers-110k-drain/"}]},{"content":"No SEC enforcement actions, CFTC proceedings, DOJ investigations, court filings, or other regulatory actions against Ambient Finance or its parent entity Crocodile Labs were identified in sources reviewed for this investigation. The protocol does not have a publicly launched token as of June 2026, which reduces one dimension of potential securities law exposure. The involvement of Circle Ventures (Circle being a regulated stablecoin issuer) and institutional investors such as Jane Street suggests the project passed investor-level due diligence at the time of the 2023 seed round.","heading":"Regulatory and Legal Status","severity":"low","sources":[{"credibility":3,"name":"Ambient Finance (ex CrocSwap) - ICO Analytics","type":"research","url":"https://icoanalytics.org/projects/ambient-finance/"}]}],"sources_used":[{"credibility":1,"name":"Introduction to Ambient - Ambient Docs","type":"official","url":"https://docs.ambient.finance/"},{"credibility":1,"name":"Ambient TVL, Fees, Revenue, Volume - DefiLlama","type":"on_chain","url":"https://defillama.com/protocol/ambient"},{"credibility":1,"name":"Ambient Finance website hacked, team warns users to wait for fix - CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/ambient-finance-frontend-hacked-team-warns-users-wait"},{"credibility":2,"name":"Ethereum DeFi Protocol Ambient Finance Suffers $110K Drain - Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/06/08/ethereum-defi-protocol-ambient-finance-suffers-110k-drain/"},{"credibility":2,"name":"Ambient Finance confirms funds are safe - Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/ambient-finance-confirms-funds-are-safe/"},{"credibility":2,"name":"DeFi Exchange Defeats DNS Attack: Ambient Finance Recovers Domain - CryptoNews","type":"news_article","url":"https://cryptonews.com/news/defi-exchange-defeats-dns-attack-ambient-finance-recovers-domain/"},{"credibility":2,"name":"Circle-backed decentralized exchange Ambient Finance faces front-end hack: Blockaid - Crypto.news","type":"news_article","url":"https://crypto.news/circle-backed-decentralized-exchange-ambient-finance-faces-front-end-hack-blockaid/"},{"credibility":2,"name":"Ambient Finance confirms funds are safe, warns users to avoid frontend post-attack - Mitrade","type":"news_article","url":"https://www.mitrade.com/insights/news/live-news/article-3-420586-20241019"},{"credibility":2,"name":"Ambient Finance Frontend DNS Hijacking - Quadriga Initiative","type":"community_report","url":"https://quadrigainitiative.com/cryptocurrencyhackscamfraudwiki/index.php?title=Ambient_Finance_Frontend_DNS_Hijacking"},{"credibility":2,"name":"Ambient Finance - CertiK Skynet Project Insight","type":"research","url":"https://skynet.certik.com/projects/ambient-finance"},{"credibility":2,"name":"Ambient Finance Raises Seed Round Funding - CrocSwap Medium","type":"official","url":"https://crocswap.medium.com/ambient-finance-raises-seed-round-funding-78328f4fa7e"},{"credibility":2,"name":"Ambient Finance Seed Round - CoinCarp","type":"research","url":"https://www.coincarp.com/fundraising/ambient-finance-seed/"},{"credibility":2,"name":"Ambient Finance Overview - Rootdata","type":"research","url":"https://www.rootdata.com/Projects/detail/Ambient%2BFinance?k=Mjk0Ng%3D%3D"},{"credibility":2,"name":"Ambient Finance Overview - SoSoValue","type":"research","url":"https://sosovalue.com/project/ambient-finance-1844234449004220418"},{"credibility":2,"name":"Potential Ambient Airdrop - CoinGecko","type":"news_article","url":"https://www.coingecko.com/learn/potential-ambient-airdrop-earn-ambient-points"},{"credibility":3,"name":"Everything To Know About Douglas Colkitt, The Co-Founder of Ambient Finance","type":"news_article","url":"https://usethebitcoin.com/crypto-personalities/douglas-colkitt-ambient-finance/"},{"credibility":3,"name":"ambient_finance on X - all-clear announcement","type":"social_media","url":"https://x.com/ambient_finance/status/1848035595051839542"}],"summary":"Ambient Finance (formerly CrocSwap, operated by Crocodile Labs) is a decentralized exchange protocol running its entire DEX inside a single smart contract, deployed on Ethereum and several Layer 2 networks. The project raised $6.5 million in a seed round in July 2023 from credible institutional investors including BlockTower Capital, Jane Street, and Circle Ventures. It has experienced two notable security incidents: a DNS hijacking attack in October 2024 that compromised its frontend, and an on-chain smart contract exploit in June 2026 that resulted in approximately $110,600 in losses.","timeline":[{"date":"2021-01-01","event":"Crocodile Labs founded by Douglas Colkitt; protocol developed under the name CrocSwap","source":"Rootdata / SoSoValue","source_url":"https://www.rootdata.com/Projects/detail/Ambient%2BFinance?k=Mjk0Ng%3D%3D"},{"date":"2023-07-11","event":"Ambient Finance (formerly CrocSwap) raises $6.5 million seed round led by BlockTower Capital; investors include Jane Street, Circle Ventures, Naval Ravikant, Quantstamp, and others at $80M network valuation","source":"CrocSwap Medium / CoinCarp","source_url":"https://crocswap.medium.com/ambient-finance-raises-seed-round-funding-78328f4fa7e"},{"date":"2023-07-01","event":"Ambient Finance mainnet launches on Ethereum","source":"Rootdata","source_url":"https://www.rootdata.com/Projects/detail/Ambient%2BFinance?k=Mjk0Ng%3D%3D"},{"date":"2024-03-01","event":"Ambient Finance launches on Blast mainnet; Ambient Points Season 1 goes live, coinciding with significant TVL growth","source":"ambient_finance on X","source_url":"https://x.com/ambient_finance/status/1763316403040608464"},{"date":"2024-10-17","event":"Ambient Finance frontend DNS hijacked; Inferno Drainer malware deployed via malicious domain clone; team warns users not to interact with the site","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/ambient-finance-frontend-hacked-team-warns-users-wait"},{"date":"2024-10-19","event":"Ambient Finance recovers domain; transfers to hardened registrar; team confirms on-chain contracts and protocol funds unaffected; states affected users were reimbursed","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/ambient-finance-confirms-funds-are-safe/"},{"date":"2024-10-21","event":"Ambient Finance issues all-clear; frontend confirmed safe to interact with again","source":"ambient_finance on X","source_url":"https://x.com/ambient_finance/status/1848035595051839542"},{"date":"2026-06-08","event":"Ambient Finance suffers on-chain exploit on Ethereum; approximately $110,600 drained; TenArmorAlert discloses the incident; funds routed through Uniswap V4","source":"Crypto Times","source_url":"https://www.cryptotimes.io/2026/06/08/ethereum-defi-protocol-ambient-finance-suffers-110k-drain/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 2d504447-78e0-463c-a874-bc029f62a412copy
2. #2reviewby reviewerreviewer

   2026-08-27 06:09:23Z
   Score: 58 → 58 (no score change)
   The page's core factual scaffolding (identity of the entity, founder background, funding round, deployment chains, and the occurrence and rough magnitude of both security incidents) is well corroborated by independent sources, and the page appropriately avoids two common corpus defects: it does not assert an unconfirmed root cause for the June 2026 exploit as settled fact, and it does not misrepresent an investor relationship (Quantstamp) or an automated scoring tool (CertiK Skynet) as a completed audit. However, several timeline dates around the October 2024 DNS-hijack recovery are misdated by one to several days relative to the team's own tweets and a community incident log, the July 2023 Ethereum mainnet-launch date is off by roughly two weeks per contemporaneous reporting, the page's own arithmetic for the June 2026 exploit's 'net gain' does not follow from the ETH figures it cites, and the page materially understates Ambient's cumulative trading volume relative to the DefiLlama source it cites.
   anchoranchored

   chain

   ●mainnet-betaslot 443,524,408

   sig

   4GwkPKAPpkqR…pYUSLV7Fcopyexplorer ↗

   hash

   3cnbA9vGycEC…ky2cphZScopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1365 B) ▸

   {"actor":"reviewer","decided_at":"2026-08-27T06:09:23.158Z","decision":"review","investigation_id":"15c90e9f-a964-4aa4-8358-196a48fbbd4d","new_score":58,"page_slug":"ambient-finance","prev_score":58,"reason":"The page's core factual scaffolding (identity of the entity, founder background, funding round, deployment chains, and the occurrence and rough magnitude of both security incidents) is well corroborated by independent sources, and the page appropriately avoids two common corpus defects: it does not assert an unconfirmed root cause for the June 2026 exploit as settled fact, and it does not misrepresent an investor relationship (Quantstamp) or an automated scoring tool (CertiK Skynet) as a completed audit. However, several timeline dates around the October 2024 DNS-hijack recovery are misdated by one to several days relative to the team's own tweets and a community incident log, the July 2023 Ethereum mainnet-launch date is off by roughly two weeks per contemporaneous reporting, the page's own arithmetic for the June 2026 exploit's 'net gain' does not follow from the ETH figures it cites, and the page materially understates Ambient's cumulative trading volume relative to the DefiLlama source it cites.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 1c36a16b-c4d2-47f5-8798-23a6d3e6e955copy
3. #3review reviseby judgejudge

   2026-08-27 06:09:23Z
   Score: 58 → 48 (-10)
   Of 24 fact-checked claims, 5 were disputed and 4 partially supported, giving a disputed rate of 20.8% (5/24), which falls in the moderate-minor band. The most notable defect (claim_findings[12]) is that the page's sentence deriving a 'net gain of roughly $110,600' from 50 ETH seeded and 83.72 ETH withdrawn does not follow arithmetically (83.72 - 50 = 33.72 ETH, ~$56,700) -- but the $110,600 total-loss figure itself is independently corroborated elsewhere on the page (claim_findings[11]), so this is a flawed derivation sentence rather than a wrong headline number. Separately, the page understates Ambient's cumulative trading volume by roughly 10x against its own cited DefiLlama source (claim_findings[15]), and three timeline dates around the 2023 mainnet launch and the October 2024 DNS-hijack recovery are off by days to weeks against contemporaneous or primary sources (claim_findings[20], [22], [23]) without changing the substance of what happened. Weighing in the page's favor, it avoided two of the most common defects in this review process: it did not assert the single-contract design as a confirmed cause of the exploits (claim_findings[13]) and it correctly avoided treating an investor relationship (Quantstamp) or an automated scoring tool (CertiK Skynet) as a real audit (claim_findings[16]). No citations were found to be dead or stale. A high-priority coverage gap was flagged: the page never examines who controls admin/upgrade keys on the single contract, which is directly relevant to its own stated risk thesis and should be addressed even though it does not itself constitute a factual error.
   anchoranchored

   chain

   ●mainnet-betaslot 443,524,512

   sig

   2EckHhf1avpW…UFiRZiPocopyexplorer ↗

   hash

   BpKGMxTA6vV3…TDUps3Wscopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1979 B) ▸

   {"actor":"judge","decided_at":"2026-08-27T06:09:23.158Z","decision":"review_revise","investigation_id":"15c90e9f-a964-4aa4-8358-196a48fbbd4d","new_score":48,"page_slug":"ambient-finance","prev_score":58,"reason":"Of 24 fact-checked claims, 5 were disputed and 4 partially supported, giving a disputed rate of 20.8% (5/24), which falls in the moderate-minor band. The most notable defect (claim_findings[12]) is that the page's sentence deriving a 'net gain of roughly $110,600' from 50 ETH seeded and 83.72 ETH withdrawn does not follow arithmetically (83.72 - 50 = 33.72 ETH, ~$56,700) -- but the $110,600 total-loss figure itself is independently corroborated elsewhere on the page (claim_findings[11]), so this is a flawed derivation sentence rather than a wrong headline number. Separately, the page understates Ambient's cumulative trading volume by roughly 10x against its own cited DefiLlama source (claim_findings[15]), and three timeline dates around the 2023 mainnet launch and the October 2024 DNS-hijack recovery are off by days to weeks against contemporaneous or primary sources (claim_findings[20], [22], [23]) without changing the substance of what happened. Weighing in the page's favor, it avoided two of the most common defects in this review process: it did not assert the single-contract design as a confirmed cause of the exploits (claim_findings[13]) and it correctly avoided treating an investor relationship (Quantstamp) or an automated scoring tool (CertiK Skynet) as a real audit (claim_findings[16]). No citations were found to be dead or stale. A high-priority coverage gap was flagged: the page never examines who controls admin/upgrade keys on the single contract, which is directly relevant to its own stated risk thesis and should be addressed even though it does not itself constitute a factual error.","score_delta":-10,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision bdf6e361-9077-49ca-b24b-7ecc2f7beb2ccopy