← Beanstalk1 decision on this page
Audit log
Every state-changing event for Beanstalk: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.
- #1publishby system:backfill2026-05-19 21:12:20ZScore: ? → ? (no score change)anchoranchored
- chain
- ●mainnet-betaslot 420,848,150
- sig
8oDp3SmThmSn…JRNAy9Nuexplorer ↗- hash
67VAbsxWX3fV…c2ZSDh8Nsha256 → base58
verifying row…full verify ↗canonical bytes (6378 B) ▸
{"actor":"system:backfill","investigation_id":"fedd4b2c-80f6-4551-8c7b-8cbb51a55c28","kind":"publish","page_slug":"beanstalk","published_at":"2026-05-19T21:12:20.736Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Beanstalk","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/tech/2022/04/17/attacker-drains-182m-from-beanstalk-stablecoin-protocol"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/once-hacked-for-77m-beanstalk-s-algo-stablecoin-protocol-relaunches"},{"credibility":3,"name":"","type":"other","url":"https://bean.money/beanstalk.pdf"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://rekt.news/beanstalk-rekt"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-beanstalk-hack-april-2022"},{"credibility":3,"name":"","type":"other","url":"https://www.bleepingcomputer.com/news/security/beanstalk-defi-platform-loses-182-million-in-flash-loan-attack/"},{"credibility":3,"name":"","type":"other","url":"https://medium.com/immunefi/hack-analysis-beanstalk-governance-attack-april-2022-f42788fc821e"},{"credibility":3,"name":"","type":"other","url":"https://www.bloomberg.com/news/articles/2022-04-18/defi-project-beanstalk-loses-182-million-in-flash-loan-attack"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://rekt.news/beanstalk-rekt"},{"credibility":3,"name":"","type":"other","url":"https://blog.merklescience.com/hacktrack/hack-track-analysis-of-beanstalk-flash-loan-attack-hack-track-merkle-science"},{"credibility":3,"name":"","type":"other","url":"https://www.certik.com/resources/blog/revisiting-beanstalk-farms-exploit"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/beanstalk-farms-offers-plea-deal-to-perpetrators-of-76m-exploit"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/once-hacked-for-77m-beanstalk-s-algo-stablecoin-protocol-relaunches"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2022/06/02/beanstalk-stablecoin-protocol-barn-raise-aims-to-restore-77m-in-lost-funds"},{"credibility":3,"name":"","type":"other","url":"https://bean.money/blog/path-forward"},{"credibility":3,"name":"","type":"other","url":"https://www.techtarget.com/searchsecurity/news/252516215/Cryptocurrency-theft-leaves-Beanstalk-Farms-future-in-doubt"},{"credibility":3,"name":"","type":"other","url":"https://defillama.com/protocol/beanstalk"},{"credibility":3,"name":"","type":"other","url":"https://github.com/Cyfrin/2024-04-beanstalk-2"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.bankinfosecurity.com/stablecoin-protocol-beanstalk-loses-millions-in-attack-a-18918"},{"credibility":3,"name":"","type":"other","url":"https://www.bleepingcomputer.com/news/security/beanstalk-defi-platform-loses-182-million-in-flash-loan-attack/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://rekt.news/beanstalk-rekt"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-beanstalk-hack-april-2022"},{"credibility":3,"name":"","type":"other","url":"https://defillama.com/protocol/beanstalk"},{"credibility":3,"name":"","type":"other","url":"https://www.coingecko.com/en/coins/bean"}]}],"sources_used":[],"summary":"Beanstalk is an Ethereum-based algorithmic stablecoin protocol that on April 17, 2022 suffered one of DeFi's largest governance exploits, losing approximately $182 million after an attacker used flash loans to acquire a supermajority vote and pass a malicious proposal draining the protocol's treasury. The protocol relaunched in August 2022 following a community fundraiser called the Barn Raise, but its BEAN stablecoin has never recovered its peg and total value locked remains a fraction of pre-exploit levels.","timeline":[{"date":"2021-08-06","event":"Beanstalk protocol launched on Ethereum mainnet by pseudonymous founders 'Publius' (Benjamin Weintraub, Brendan Sanderson, Michael Montoya).","source":""},{"date":"2022-04-16","event":"Attacker submits malicious BIP-18 and BIP-19 governance proposals to Beanstalk, initiating the required 24-hour governance delay.","source":""},{"date":"2022-04-17","event":"At approximately 12:24 PM UTC, attacker executes flash loan attack using over $1 billion borrowed from Aave, acquires ~79% of governance votes, passes BIP-18 via emergencyCommit, and drains approximately $182 million from the protocol. Approximately 24,930 ETH ($76M net profit) is transferred to Tornado Cash in 270 transactions.","source":""},{"date":"2022-04-18","event":"Beanstalk Farms team pauses the protocol, disables on-chain governance, and transfers control to a community multisig. Founders reveal their identities on Discord to dispel complicity concerns.","source":""},{"date":"2022-04-18","event":"Beanstalk Farms sends on-chain message offering attacker a 10% whitehat bounty in exchange for returning 90% of funds. Attacker does not respond.","source":""},{"date":"2022-06-06","event":"Barn Raise fundraiser launches, targeting $77 million in recapitalization via Fertilizer token sales.","source":""},{"date":"2022-08-04","event":"BIP-21 (the Replant proposal) reaches supermajority. Barn Raise has attracted over $17 million USDC — approximately 22% of the target.","source":""},{"date":"2022-08-06","event":"Beanstalk protocol officially relaunches ('Replant') with governance under community multisig and restructured tokenomics.","source":""},{"date":"2024-04-01","event":"Cyfrin conducts security audit of Beanstalk 2 upgrade, including BEAN:wstETH liquidity whitelisting.","source":""},{"date":"2024-05-01","event":"Cyfrin conducts security audit of Beanstalk 3, which includes plans for Ethereum L2 migration.","source":""},{"date":"2025-05-01","event":"BEAN trades at approximately $0.23 (77% below peg). Protocol TVL approximately $9 million. Attacker identity remains unknown; stolen funds unrecovered.","source":""}]},"v":1}Verify offline (run on your own machine)python -m src.verify_decision 913bb210-2d22-4983-8779-80e842295d59
How verification works. The “Row integrity” check above is computed in your browser — your machine recomputes the SHA-256 of the canonical bytes and compares against the stored hash. No avoid.net server can fake that check. The “full verify” link goes one level deeper: your browser fetches the on-chain transaction from a Solana RPC node and confirms the same hash is in the memo. If you don’t want to trust either avoid.net or the public RPC, run the CLI verifier on your own machine —
python -m src.verify_decision <event_id>.