Audit log

Every state-changing event for Ankr: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-28 16:29:12Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,756,724

   sig

   4fnUf8ERbZqB…NQfNjPcfcopyexplorer ↗

   hash

   44EDSHq2t28n…NSfTxDYScopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6628 B) ▸

   {"actor":"system:backfill","investigation_id":"7a1254db-5cf5-448b-99b9-e773bf1ae9ee","kind":"publish","page_slug":"ankr","published_at":"2026-05-28T16:29:12.313Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Ankr","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://kriptomat.io/cryptocurrencies/ankr/what-is-ankr/","type":"other","url":""},{"credibility":3,"name":"https://www.ankr.com/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.ankr.com/blog/after-action-report-our-findings-from-abnbc-token-exploit/","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/ankr-confirms-exploit-asks-for-immediate-trading-halt","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/ankr-helio-rekt","type":"other","url":""},{"credibility":3,"name":"https://www.merklescience.com/blog/hack-track-analysis-of-ankr-exploit","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/business/2022/12/21/defi-protocol-ankr-says-ex-employee-caused-5m-exploit","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/ankr-helio-rekt","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/ankr-deploys-15m-to-make-whole-users-as-helio-stablecoin-recovers-after-exploit","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2022/12/03/helio-protocol-exploited-for-15m-after-ankr-exploit/","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/bnb-based-hay-destablecoin-loses-peg-ankr-exploit/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.ankr.com/blog/after-action-report-our-findings-from-abnbc-token-exploit/","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/ankr-says-ex-employee-caused-5m-exploit-vows-to-improve-security","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/business/2022/12/21/defi-protocol-ankr-says-ex-employee-caused-5m-exploit","type":"other","url":""},{"credibility":3,"name":"https://blockworks.co/news/ankr-confirms-5m-crypto-hack-was-an-inside-job","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cointelegraph.com/news/ankr-exploit-victims-group-alleges-the-company-only-reimbursed-them-50","type":"other","url":""},{"credibility":3,"name":"https://zycrypto.com/ankr-reveals-compensation-plan-for-users-affected-by-5-million-hack/","type":"other","url":""},{"credibility":3,"name":"https://www.ankr.com/blog/the-details-of-ankrs-bnb-exploit-relief-efforts-and-our-stance-on-compensation/","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/markets/2022/12/02/defi-protocol-ankr-exploited-for-over-5m","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.ankr.com/blog/after-action-report-our-findings-from-abnbc-token-exploit/","type":"other","url":""},{"credibility":3,"name":"https://www.ankr.com/blog/ankr-2025-wrap-up/","type":"other","url":""},{"credibility":3,"name":"https://www.ankr.com/blog/ankr-approach-to-safety-risk-and-protecting-our-community/","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/ankr-says-ex-employee-caused-5m-exploit-vows-to-improve-security","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://zachxbt.mirror.xyz/","type":"other","url":""},{"credibility":3,"name":"https://medium.com/@investigationsbyzachxbt","type":"other","url":""}]}],"sources_used":[],"summary":"Ankr is a Web3 infrastructure and liquid staking protocol founded in 2017, providing RPC endpoints for over 75 blockchains and BNB Chain-based liquid staking products. In December 2022, a former employee executed a supply chain attack that compromised Ankr's private deployer key, enabling unlimited minting of aBNBc tokens and resulting in approximately $5 million in direct losses, with cascading secondary losses of roughly $19 million through Helio Protocol's HAY stablecoin depeg. Ankr subsequently compensated affected users, implemented multi-signature controls, and continues to operate, though questions persist over the completeness of user reimbursement.","timeline":[{"date":"2017-01-01","event":"Ankr founded by Chandler Song, Ryan Fang, and Stanley Wu.","source":""},{"date":"2019-03-01","event":"ANKR token launched via ICO on Binance Launchpad, raising approximately $18.7 million.","source":""},{"date":"2019-01-01","event":"Ankr mainnet released.","source":""},{"date":"2020-01-01","event":"Ankr launches Stkr liquid staking protocol, introducing aBNBc and related derivatives.","source":""},{"date":"2022-12-01","event":"Former Ankr employee's malicious supply chain code activates upon a legitimate software update, exfiltrating the deployer private key.","source":""},{"date":"2022-12-02","event":"Attacker deploys malicious aBNBc contract and mints approximately 60 trillion aBNBc tokens. PeckShield flags exploit at 12:35 UTC. Approximately $5 million extracted via PancakeSwap and bridged to Ethereum. aBNBc price crashes ~99.5%.","source":""},{"date":"2022-12-02","event":"Secondary exploit against Helio Protocol: attackers use collapsed aBNBc as collateral to drain approximately $15.5 million from Helio's HAY stablecoin pool via an unupdated price oracle. HAY depegs to $0.20.","source":""},{"date":"2022-12-02","event":"Approximately 3,360 ETH laundered through Tornado Cash; additional 900 BNB sent through Tornado Cash.","source":""},{"date":"2022-12-02","event":"Ankr issues public statement confirming exploit, requests trading halt on aBNBc, announces compensation plan.","source":""},{"date":"2022-12-21","event":"Ankr formally attributes attack to a former team member, announces law enforcement referral, and details new multi-signature security controls.","source":""},{"date":"2023-01-01","event":"Victims group publicly alleges Ankr provided only 50% reimbursement to users affected through Stader and pStake protocols.","source":""},{"date":"2024-01-01","event":"Ankr's Asphere enterprise arm achieves SOC 2 Type 1 compliance.","source":""},{"date":"2025-01-01","event":"Ankr's Asphere achieves SOC 2 Type 2 compliance. No public confirmation of prosecution of the former employee has been reported.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision e83dfcdc-3426-4af3-9f82-5222aa33c59bcopy
2. #2reviewby reviewerreviewer

   2026-06-14 23:16:00Z
   Score: 38 → 38 (no score change)
   Blue-chip calibration review (Prompt A). Verdict: over-penalized. Page content is treated as accurate; the trust_score band is miscalibrated. Ankr is a legitimate, operating Web3 infrastructure company founded in 2017 that suffered a material insider attack in December 2022 when a former employee executed a supply chain exploit. The company responded by compensating the vast majority of affected users at 100% (17 of 19 protocols), implementing multi-signature security controls, and continuing to grow its enterprise infrastructure business (SOC2 Type 1 achieved 2024, Type 2 in progress). There is no evidence of fraud, exit scam, Ponzi mechanics, or regulatory enforcement. The current score of 38 (WARNING band) is over-penalized: it conflates Ankr being a victim of an insider crime with Ankr being a fraudulent operator, and it partially attributes Helio Protocol's separate architectural vulnerability to Ankr's culpability. The unresolved material caveats — a narrow partial-compensation dispute with a subset of LP users, no public prosecution confirmation, and a single historical insider-attack — appropriately place Ankr in CAUTIONARY (50-69) rather than WARNING. A score of 58 reflects the serious but resolved nature of the incident, the company's substantive compensatory response, and its continued operation as a credible infrastructure provider.
   anchoranchored

   chain

   ●mainnet-betaslot 426,514,522

   sig

   5tB4SCXHNujU…xHTsSXXvcopyexplorer ↗

   hash

   AqrHcu4zqecH…hYc33RRzcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1706 B) ▸

   {"actor":"reviewer","decided_at":"2026-06-14T23:16:00.536Z","decision":"review","investigation_id":"7a1254db-5cf5-448b-99b9-e773bf1ae9ee","new_score":38,"page_slug":"ankr","prev_score":38,"reason":"Blue-chip calibration review (Prompt A). Verdict: over-penalized. Page content is treated as accurate; the trust_score band is miscalibrated. Ankr is a legitimate, operating Web3 infrastructure company founded in 2017 that suffered a material insider attack in December 2022 when a former employee executed a supply chain exploit. The company responded by compensating the vast majority of affected users at 100% (17 of 19 protocols), implementing multi-signature security controls, and continuing to grow its enterprise infrastructure business (SOC2 Type 1 achieved 2024, Type 2 in progress). There is no evidence of fraud, exit scam, Ponzi mechanics, or regulatory enforcement. The current score of 38 (WARNING band) is over-penalized: it conflates Ankr being a victim of an insider crime with Ankr being a fraudulent operator, and it partially attributes Helio Protocol's separate architectural vulnerability to Ankr's culpability. The unresolved material caveats — a narrow partial-compensation dispute with a subset of LP users, no public prosecution confirmation, and a single historical insider-attack — appropriately place Ankr in CAUTIONARY (50-69) rather than WARNING. A score of 58 reflects the serious but resolved nature of the incident, the company's substantive compensatory response, and its continued operation as a credible infrastructure provider.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 014ed1e0-a1a2-4c52-8ffb-34761eafa53ccopy
3. #3review approveby judgejudge

   2026-06-14 23:16:00Z
   Score: 38 → 58 (+20)
   This is a severity-calibration adjudication. The reviewer found zero disputed claims (disputed_pct = 0%) and confirmed all six claim_findings as supported. Ankr suffered an insider supply chain attack by a former employee in December 2022 — it was not a fraudulent operator. The current score of 38 (WARNING band) over-penalizes the entity by attributing Helio Protocol's separate oracle vulnerability (claim_findings[2], ~$15–15.5M in Helio losses) as Ankr's direct culpability, and by understating that 17 of 19 affected protocols received 100% compensation (claim_findings[1]). The remaining caveats — a narrow 50% partial-reimbursement dispute with Stader/pStake LP users and no confirmed prosecution — are real but do not rise to WARNING severity for a company with no regulatory enforcement (claim_findings[4]) and active legitimate operations serving 80+ blockchains (claim_findings[5]). A score of 58 in the CAUTIONARY band correctly reflects the serious-but-resolved nature of the incident. Reviewer confidence was 0.82; this verdict is consistent with that confidence level.
   anchoranchored

   chain

   ●mainnet-betaslot 426,514,528

   sig

   2KBfrv1mCqFt…Lyy7kGBFcopyexplorer ↗

   hash

   9e9TDMXKDRbn…PbW1hKVpcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1430 B) ▸

   {"actor":"judge","decided_at":"2026-06-14T23:16:00.536Z","decision":"review_approve","investigation_id":"7a1254db-5cf5-448b-99b9-e773bf1ae9ee","new_score":58,"page_slug":"ankr","prev_score":38,"reason":"This is a severity-calibration adjudication. The reviewer found zero disputed claims (disputed_pct = 0%) and confirmed all six claim_findings as supported. Ankr suffered an insider supply chain attack by a former employee in December 2022 — it was not a fraudulent operator. The current score of 38 (WARNING band) over-penalizes the entity by attributing Helio Protocol's separate oracle vulnerability (claim_findings[2], ~$15–15.5M in Helio losses) as Ankr's direct culpability, and by understating that 17 of 19 affected protocols received 100% compensation (claim_findings[1]). The remaining caveats — a narrow 50% partial-reimbursement dispute with Stader/pStake LP users and no confirmed prosecution — are real but do not rise to WARNING severity for a company with no regulatory enforcement (claim_findings[4]) and active legitimate operations serving 80+ blockchains (claim_findings[5]). A score of 58 in the CAUTIONARY band correctly reflects the serious-but-resolved nature of the incident. Reviewer confidence was 0.82; this verdict is consistent with that confidence level.","score_delta":20,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision db2543a8-e14a-4929-8f72-3a67ddf529f5copy
4. #4reviewby reviewerreviewer

   2026-10-16 05:03:38Z
   Score: 58 → 58 (no score change)
   The page's core narrative -- the December 2022 insider-driven supply chain attack on Ankr's deployer key, the resulting aBNBc hyperinflation and ~$5M direct loss, the cascading Helio/HAY depeg exploit (~$19M additional), Tornado Cash laundering, and the subsequent compensation dispute with Stader/pStake users -- is well supported by multiple independent, credible sources (Ankr's own after-action report, rekt.news, Cointelegraph, CoinDesk, Merkle Science) and the on-chain addresses and function selector check out exactly against independent analyses. The most significant problems are in the Background section: the ICO date and platform claim (March 2019 Binance Launchpad) does not match any source found, including the page's own citations -- independent sources place Ankr's token sale in 2018 as a direct Ethereum ICO, with Binance Launchpad not yet in a position to have hosted it. The blockchain-count claim ('over 75') is also unsupported by either of the page's own two cited sources (70+ and 40+ respectively). A more consequential error is in the Helio section: the claim that Helio 'repurchased and burned approximately 15 million HAY to restore the peg to near $0.99' conflates the $15 million (USD) buyback commitment with an actual 15-million-token burn, and overstates the recovery price; contemporaneous sources (including one of the page's own citations) show recovery to roughly $0.96 and documented repurchase volumes in the single digits of millions of HAY. The ZachXBT flagging section is honestly hedged by the page itself as unverified, which this review confirms remains the case. No accepted community submissions existed to independently assess.
   anchoranchored

   chain

   ●mainnet-betaslot 457,513,790

   sig

   7FV9CoHSPUVZ…Gj1qQR5hcopyexplorer ↗

   hash

   ADQj1tKKh7hV…wwJey6gecopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (2267 B) ▸

   {"actor":"reviewer","artifact_identity":"26e07a6474bd9e75d3d1ee61d43a4cb8","decided_at":"2026-10-16T05:03:37.902Z","decision":"review","disputed_pct":0.2857,"findings_hash":"2BrZiDCaDk98edVrv27FHnE4mpUVPqCvCdvAHoNDrkSX","investigation_id":"7a1254db-5cf5-448b-99b9-e773bf1ae9ee","mode":"findings_only","new_score":58,"page_content_hash":"2e9b47d678202e7b2707f7974fca4ba86fc56c5d0ea0c48903dd588da21681da","page_slug":"ankr","prev_score":58,"reason":"The page's core narrative -- the December 2022 insider-driven supply chain attack on Ankr's deployer key, the resulting aBNBc hyperinflation and ~$5M direct loss, the cascading Helio/HAY depeg exploit (~$19M additional), Tornado Cash laundering, and the subsequent compensation dispute with Stader/pStake users -- is well supported by multiple independent, credible sources (Ankr's own after-action report, rekt.news, Cointelegraph, CoinDesk, Merkle Science) and the on-chain addresses and function selector check out exactly against independent analyses. The most significant problems are in the Background section: the ICO date and platform claim (March 2019 Binance Launchpad) does not match any source found, including the page's own citations -- independent sources place Ankr's token sale in 2018 as a direct Ethereum ICO, with Binance Launchpad not yet in a position to have hosted it. The blockchain-count claim ('over 75') is also unsupported by either of the page's own two cited sources (70+ and 40+ respectively). A more consequential error is in the Helio section: the claim that Helio 'repurchased and burned approximately 15 million HAY to restore the peg to near $0.99' conflates the $15 million (USD) buyback commitment with an actual 15-million-token burn, and overstates the recovery price; contemporaneous sources (including one of the page's own citations) show recovery to roughly $0.96 and documented repurchase volumes in the single digits of millions of HAY. The ZachXBT flagging section is honestly hedged by the page itself as unverified, which this review confirms remains the case. No accepted community submissions existed to independently assess.","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 3a851fd2-4151-4f19-b8c5-07ad6ae195facopy
5. #5rescoreby systemsystem

   2026-10-27 06:05:44Z
   Score: 58 → 63 (+5)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 58 → 63. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −3.2, problems around the subject, caused by others −2.4; legitimacy credit long-running +10; 1 section(s) set aside until a failed fact-check is resolved; fact-check adjustments (+20) now shown as page reliability, not in the score.
   anchoranchored

   chain

   ●mainnet-betaslot 461,965,715

   sig

   4Hd4BKcjA2pP…z9WQ3ovrcopyexplorer ↗

   hash

   Hbnf46sXptXZ…Hp2hdaLLcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (775 B) ▸

   {"actor":"system","decided_at":"2026-10-27T06:05:44.049Z","decision":"rescore","investigation_id":"7a1254db-5cf5-448b-99b9-e773bf1ae9ee","new_score":63,"page_slug":"ankr","prev_score":58,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 58 → 63. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −3.2, problems around the subject, caused by others −2.4; legitimacy credit long-running +10; 1 section(s) set aside until a failed fact-check is resolved; fact-check adjustments (+20) now shown as page reliability, not in the score.","score_delta":5,"score_model":"v2","sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision f1ede688-c9a5-4f1d-9750-86d81e0043bacopy