Audit log

Every state-changing event for BingX: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-20 04:21:57Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 420,912,723

   sig

   TNoKQxesXdde…k6stogULcopyexplorer ↗

   hash

   9XB9QAf6ES4L…nyBPpxadcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6212 B) ▸

   {"actor":"system:backfill","investigation_id":"1e8bb53f-36c7-49e5-82a4-1f6f83a90360","kind":"publish","page_slug":"bingx","published_at":"2026-05-20T04:21:57.300Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"BingX","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://bingx.com/en/about"},{"credibility":3,"name":"","type":"other","url":"https://www.crunchbase.com/organization/bingx"},{"credibility":3,"name":"","type":"other","url":"https://bitcoinwiki.org/wiki/bingx"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.dlnews.com/articles/markets/bingx-dismiss-hack-cover-up-restore-deposit-withdrawal/"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/tech/2024/09/20/crypto-exchange-bingx-hacked-onchain-data-shows-over-43m-drained"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-bingx-hack-september-2024"},{"credibility":3,"name":"","type":"other","url":"https://blog.bingx.com/bingx-updates/ama-recap-with-bingx-cpo-vivien-lin-addressing-the-recent-hot-wallet-incident/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://cryptoslate.com/north-korea-linked-hack-costs-crypto-exchange-bingx-52-million-in-crypto-assets/"},{"credibility":3,"name":"","type":"other","url":"https://www.odaily.news/en/newsflash/420298"},{"credibility":3,"name":"","type":"other","url":"https://www.chaincatcher.com/en/article/2169265"},{"credibility":3,"name":"","type":"other","url":"https://www.panewslab.com/en/sqarticledetails/9w3i915j.html"},{"credibility":3,"name":"","type":"other","url":"https://news.bitcoin.com/bingx-hit-with-52-million-hack-lazarus-group-suspected/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://finance.yahoo.com/news/bingx-secures-compliance-license-us-150008425.html"},{"credibility":3,"name":"","type":"other","url":"https://www.datawallet.com/crypto/bingx-restricted-countries"},{"credibility":3,"name":"","type":"other","url":"https://www.prnewswire.com/in/news-releases/bingx-secures-compliance-licenses-in-the-united-states-and-canada-to-further-improve-the-global-security-system-862425432.html"},{"credibility":3,"name":"","type":"other","url":"https://www.coinperps.com/learn/bingx-restricted-countries"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://bingx.com/en/insurance-fund"},{"credibility":3,"name":"","type":"other","url":"https://blog.bingx.com/bingx-updates/20286/"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-bingx-hack-september-2024"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/bing-x-confirms-resumption-withdrawal-services"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-bingx-hack-september-2024"},{"credibility":3,"name":"","type":"other","url":"https://www.dlnews.com/articles/markets/bingx-dismiss-hack-cover-up-restore-deposit-withdrawal/"},{"credibility":3,"name":"","type":"other","url":"https://www.datawallet.com/crypto/bingx-restricted-countries"},{"credibility":3,"name":"","type":"other","url":"https://www.chaincatcher.com/en/article/2169265"}]}],"sources_used":[],"summary":"BingX is a Singapore-headquartered centralized cryptocurrency exchange founded in 2018 (originally as Bingbon), operating across 160+ countries with over 10 million reported users. In September 2024, the exchange suffered a confirmed hot wallet breach totaling approximately $52 million across at least seven blockchain networks, with on-chain forensics subsequently linking the attack to North Korea's Lazarus Group. The exchange pledged full user compensation from reserves and resumed withdrawals within days, but independently unverified regulatory claims and initial opacity around the breach raise ongoing due-diligence concerns.","timeline":[{"date":"2018-01-01","event":"Exchange founded under the name Bingbon.","source":""},{"date":"2021-01-01","event":"Bingbon rebrands to BingX.","source":""},{"date":"2023-06-01","event":"BingX publicly announces MSB registrations in the US (FinCEN) and Canada (FINTRAC); claims not independently verified in public registrant databases.","source":""},{"date":"2024-09-20","event":"Hot wallet breach detected at approximately 4:00 AM Singapore time; BingX suspends deposits and withdrawals, initially describing the event as 'temporary wallet maintenance.' Security firms Cyvers and PeckShield flag suspicious outflows of $26–43 million across seven blockchain networks.","source":""},{"date":"2024-09-20","event":"Cyvers attributes behavioral patterns of the attacker to tactics consistent with North Korea's Lazarus Group, though formal attribution is not confirmed at this stage.","source":""},{"date":"2024-09-21","event":"BingX acknowledges the security breach publicly. CPO Vivien Lin pledges full user reimbursement from company reserves. Estimated losses revised upward to approximately $52 million.","source":""},{"date":"2024-09-21","event":"BingX begins working with SlowMist and Chainalysis on forensic investigation. $10 million in stolen assets frozen.","source":""},{"date":"2024-09-22","event":"BingX restores deposits and withdrawals for USDT, USDC, BTC, ETH, TRX, and SOL. Accusations of a cover-up dismissed by CPO Vivien Lin via public AMA.","source":""},{"date":"2025-02-22","event":"Blockchain investigator ZachXBT publishes on-chain analysis demonstrating that an address used in the BingX hack is directly connected to the address cluster behind the Phemex hack and the $1.5 billion Bybit hack, linking all three incidents to Lazarus Group.","source":""},{"date":"2025-02-23","event":"ZachXBT further links Poloniex to the same Lazarus Group cluster, identifying four major exchange hacks connected to a single threat actor.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 869d4fd5-4b14-40a3-b779-13874ba51e2fcopy
2. #2rescoreby systemsystem

   2026-10-10 18:44:34Z
   Score: 32 → 58 (+26)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 32 → 58. Problems weighed by who is responsible: concerns that are not fraud −9.6, incidents the subject suffered −6.4, problems around the subject, caused by others −0.8; legitimacy credit long-running +10.
   anchoranchored

   chain

   ●mainnet-betaslot 455,364,262

   sig

   53C8epxc4tP8…Uq3JL1rfcopyexplorer ↗

   hash

   5PinQ7GAqBpt…HfQuG2edcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (637 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:44:34.471Z","decision":"rescore","investigation_id":"1e8bb53f-36c7-49e5-82a4-1f6f83a90360","new_score":58,"page_slug":"bingx","prev_score":32,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 32 → 58. Problems weighed by who is responsible: concerns that are not fraud −9.6, incidents the subject suffered −6.4, problems around the subject, caused by others −0.8; legitimacy credit long-running +10.","score_delta":26,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision c3527106-c009-4522-8608-abf395b8f482copy
3. #3reviewby reviewerreviewer

   2026-10-27 18:53:17Z
   Score: 58 → 58 (no score change)
   The core narrative holds: a September 2024 hot wallet breach across seven chains, the 'wallet maintenance' framing, the cover-up denial, the $10M freeze and staged restoration are supported by DL News, CryptoSlate and CoinDesk. One timeline date is wrong: the FinCEN and FINTRAC announcement is dated January 2022 rather than June 2023. The $52M figure is a Cyvers estimate that the page presents as BingX's confirmed final figure. The Poloniex link, the ten-address detail and completed reimbursement were not verified. The Lazarus link is corroborated only by secondary reporting of ZachXBT's analysis, and the page's own hedging is reasonable. No subject-status contradiction was found.
   anchoranchored

   chain

   ●mainnet-betaslot 462,179,242

   sig

   jLW9FJKomfEi…ES3EgX4zcopyexplorer ↗

   hash

   9nefrJFnxJj4…Zft9Dwb3copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1531 B) ▸

   {"actor":"reviewer","artifact_identity":"622e39c59e7d37022216bc39f2d3df52","blocked_count":1,"decided_at":"2026-10-27T18:53:16.968Z","decision":"review","disputed_pct":0.4,"findings_hash":"4HgdU7wssvnMaDj16XwdVqRyD1TxJq1jM8R7w4VNVJ2p","investigation_id":"1e8bb53f-36c7-49e5-82a4-1f6f83a90360","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":58,"page_content_hash":"04155a51ee343e7d19b5f842b5167c4c85a798a4e6ef7330b21cdf2ad19d6ae7","page_slug":"bingx","prev_score":58,"reason":"The core narrative holds: a September 2024 hot wallet breach across seven chains, the 'wallet maintenance' framing, the cover-up denial, the $10M freeze and staged restoration are supported by DL News, CryptoSlate and CoinDesk. One timeline date is wrong: the FinCEN and FINTRAC announcement is dated January 2022 rather than June 2023. The $52M figure is a Cyvers estimate that the page presents as BingX's confirmed final figure. The Poloniex link, the ten-address detail and completed reimbursement were not verified. The Lazarus link is corroborated only by secondary reporting of ZachXBT's analysis, and the page's own hedging is reasonable. No subject-status contradiction was found.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":10,"sequence_num":3,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 7337754b-06bd-4ca9-9e02-a8bf635f9271copy
4. #4review reviseby judgejudge

   2026-10-27 18:53:17Z
   Score: 58 → 58 (no score change)
   Of 10 claims checked, one was excluded because its source blocked the reviewer (claim_findings[8]). Of the remaining 9, 1 was disputed and 3 could not be verified, giving about 44%, in the significant-issues band. The disputed item is the FinCEN/FINTRAC announcement dated June 2023 when the cited release is dated January 2022 (claim_findings[0]). The unverified items are the Poloniex link (claim_findings[5]), completed user reimbursement (claim_findings[7]) and the no-enforcement-action statement (claim_findings[9]). The page also presents the $52M hack figure as BingX-confirmed when sources show it as a Cyvers estimate (claim_findings[1], [2]). The core breach narrative is supported, the reviewer found no omissions or status contradiction, and reviewer confidence is moderate (0.6), so the penalty sits at the lenient end of the band.
   anchoranchored

   chain

   ●mainnet-betaslot 462,179,247

   sig

   5rdve5MFYjt1…fW2R264ccopyexplorer ↗

   hash

   4K6eJiC4H1ss…XY2SRadkcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1518 B) ▸

   {"actor":"judge","artifact_identity":"622e39c59e7d37022216bc39f2d3df52","band_override":null,"blocked_count":1,"decided_at":"2026-10-27T18:53:16.968Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.4,"investigation_id":"1e8bb53f-36c7-49e5-82a4-1f6f83a90360","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":58,"page_slug":"bingx","prev_score":58,"reason":"Of 10 claims checked, one was excluded because its source blocked the reviewer (claim_findings[8]). Of the remaining 9, 1 was disputed and 3 could not be verified, giving about 44%, in the significant-issues band. The disputed item is the FinCEN/FINTRAC announcement dated June 2023 when the cited release is dated January 2022 (claim_findings[0]). The unverified items are the Poloniex link (claim_findings[5]), completed user reimbursement (claim_findings[7]) and the no-enforcement-action statement (claim_findings[9]). The page also presents the $52M hack figure as BingX-confirmed when sources show it as a Cyvers estimate (claim_findings[1], [2]). The core breach narrative is supported, the reviewer found no omissions or status contradiction, and reviewer confidence is moderate (0.6), so the penalty sits at the lenient end of the band.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":10,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 1b3decf5-9513-45dd-8c78-601980759cb1copy