Audit log

Every state-changing event for Blockstream Jade — Fake Firmware Phishing Campaign (August 2026): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-11 23:07:06Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 443,507,156

   sig

   3c1R88gnvQSB…1sy1F5txcopyexplorer ↗

   hash

   AFwyxrz948gp…yVXgVY2acopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (23180 B) ▸

   {"actor":"system:backfill","investigation_id":"ebfb4383-754a-4e4e-b2ae-1dbf8c1fccd0","kind":"publish","page_slug":"blockstream-jade-fake-firmware-phishing-campaign-august-2026","published_at":"2026-08-11T23:07:06.273Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Blockstream Jade — Fake Firmware Phishing Campaign (August 2026)","sections":[{"content":"The Blockstream Jade fake firmware phishing campaign is a targeted email fraud operation that impersonates Blockstream — the company behind the Jade Bitcoin hardware wallet — to trick users into downloading malicious software disguised as a legitimate firmware update. Blockstream publicly disclosed the campaign on September 12, 2025, via an official post on X (formerly Twitter), stating: 'This was not sent from Blockstream. Blockstream will never email you firmware files. No data has been compromised.' Bitcoin developer Jimmy Song is reported to have first alerted Blockstream to the existence of the fraudulent emails, according to multiple crypto news outlets. A second wave of Jade-targeted phishing was documented in August 2026, coinciding with widespread attacker activity following the Coldcard hardware wallet exploit that began July 30, 2026.","heading":"Campaign Overview","severity":"high","sources":[{"credibility":1,"name":"Blockstream official X alert — @Blockstream/status/1966586521827368990","type":"official","url":"https://x.com/Blockstream/status/1966586521827368990"},{"credibility":2,"name":"CoinTelegraph: Blockstream sounds the alarm on new email phishing campaign","type":"news_article","url":"https://cointelegraph.com/news/blockstream-sounds-alarm-email-phishing-campaign"},{"credibility":2,"name":"Cryptopolitan: Blockstream warns Jade wallet users of new phishing scam","type":"news_article","url":"https://www.cryptopolitan.com/blockstream-warns-of-jade-scam/"},{"credibility":2,"name":"Decrypt: Hardware Wallet Firms Warn of Phishing Surge as Coldcard Losses Near $130M","type":"news_article","url":"https://decrypt.co/374891/hardware-wallet-firms-warn-of-phishing-surge-as-coldcard-losses-near-130m"}]},{"content":"The phishing campaign operates primarily through email. Fraudulent messages impersonate Blockstream and instruct recipients to download what is presented as a new version of the Jade wallet firmware. The emails cite firmware version numbers, though community members noted that the version numbers in the phishing emails were internally inconsistent and did not match any legitimate Blockstream release. At least one documented example showed the email purportedly sent from the 'General Manager of Adelphia Restaurant,' with download links pointing to the domain getbento.com — a domain wholly unaffiliated with Blockstream. This mismatch between claimed sender identity and actual sending domain is a strong indicator of a compromised or spoofed email infrastructure being used to distribute the campaign. The emails are crafted using urgency language typical of social engineering attacks. If a recipient were to download and install the malicious payload, security analysts assess it would likely expose private keys or redirect funds to attacker-controlled addresses, though no forensic technical details of the specific payload have been publicly disclosed. A separate, earlier phishing incident documented in October 2023 used physical mail rather than email, directing recipients to a fake emergency firmware update. In the broader August 2026 hardware wallet phishing environment triggered by the Coldcard exploit, attackers employed cloned websites, GitHub-hosted batch files, and remote-access tools (specifically ScreenConnect) — though those specific payloads have been attributed to Coldcard-targeted campaigns, not confirmed Jade-specific incidents.","heading":"Attack Vector and Tactics","severity":"high","sources":[{"credibility":2,"name":"CoinCentral: Blockstream Alerts Users of Fake Email Phishing Campaign Targeting Wallets","type":"news_article","url":"https://coincentral.com/blockstream-alerts-users-of-fake-email-phishing-campaign-targeting-wallets/"},{"credibility":2,"name":"BTCC: Blockstream Sounds Alarm on Sophisticated Phishing Campaign","type":"news_article","url":"https://www.btcc.com/en-US/square/Cryptonews/947704"},{"credibility":2,"name":"Cryptonews.net: Blockstream Jade Firmware Phishing May Target Bitcoin Users With Malicious Update Links","type":"news_article","url":"https://cryptonews.net/news/security/31612243/"},{"credibility":2,"name":"Decrypt: Hardware Wallet Firms Warn of Phishing Surge as Coldcard Losses Near $130M","type":"news_article","url":"https://decrypt.co/374891/hardware-wallet-firms-warn-of-phishing-surge-as-coldcard-losses-near-130m"}]},{"content":"How attackers obtained email addresses of Jade hardware wallet owners has not been definitively established. Blockstream's own investigation, published after the October 2023 phishing incident, concluded that 'customer data may have been exposed by either a breach or a leak from a third-party shipping provider.' Data allegedly included email addresses, telephone numbers, and shipping addresses. Blockstream stated that no private keys or wallet addresses were exposed. Some community members speculated that attackers harvested email contacts from prior data breaches affecting cryptocurrency exchanges and services, then conducted mass campaigns against the full crypto-user population. A community observer noted on the Blockstream X post that the scam email address 'was only shared with Blockstream,' suggesting at least some targeting was specific to the Blockstream customer base rather than a mass blast. No independent forensic confirmation of the data source has been published.","heading":"Suspected Source of Victim Email Addresses","severity":"medium","sources":[{"credibility":2,"name":"U.Today: Blockstream Publishes Phishing Investigation Results","type":"news_article","url":"https://u.today/blockstream-publishes-phishing-investigation-results"},{"credibility":2,"name":"U.Today: Phishing Alert — Blockstream Customers Targeted by Mail Scam","type":"news_article","url":"https://u.today/phishing-alert-blockstream-customers-targeted-by-mail-scam"},{"credibility":1,"name":"Blockstream official X alert — @Blockstream/status/1966586521827368990","type":"official","url":"https://x.com/Blockstream/status/1966586521827368990"}]},{"content":"Blockstream confirmed that no Jade devices were compromised through the campaign's fraudulent update channels, and that no user credentials or private keys were exposed through any breach of Blockstream's own systems. No confirmed financial losses attributable specifically to the fake Jade firmware campaign have been publicly documented in available sources. Blockstream stated that 'zero exploits through genuine update channels' occurred and that all confirmed incidents of user loss traced to user-initiated installations from unverified sources. The broader hardware wallet phishing environment in 2025–2026 is severe: phishing attacks cost crypto users over $12 million in August 2025 alone, affecting more than 15,000 victims — a 67 percent increase month-over-month. H1 2025 crypto crime losses exceeded $3.1 billion in total, with phishing accounting for $410 million across 132 separate attacks, according to figures cited in multiple reporting sources. These figures are sector-wide and not specific to the Jade campaign.","heading":"Confirmed Impact and Losses","severity":"medium","sources":[{"credibility":2,"name":"Cryptopolitan: Blockstream warns Jade wallet users of new phishing scam","type":"news_article","url":"https://www.cryptopolitan.com/blockstream-warns-of-jade-scam/"},{"credibility":2,"name":"BTCC: Blockstream Exposes Sophisticated Jade Wallet Fake Firmware Scam","type":"news_article","url":"https://www.btcc.com/en-US/square/Cryptopolitan/947404"},{"credibility":2,"name":"CoinCentral: Blockstream Alerts Users of Fake Email Phishing Campaign Targeting Wallets","type":"news_article","url":"https://coincentral.com/blockstream-alerts-users-of-fake-email-phishing-campaign-targeting-wallets/"}]},{"content":"The August 2026 iteration of Jade-targeted phishing is best understood in the context of the Coldcard hardware wallet exploit that began July 30, 2026. A five-year-old firmware flaw in Coinkite's Coldcard Mk3 caused seed generation to rely on a weak software random number generator rather than a hardware entropy source, effectively reducing private key strength to as few as 40 bits. Attackers exploited this to drain approximately 1,816 BTC — worth roughly $116 million — from over 5,200 addresses across four theft waves, making it the largest hardware wallet exploit on record as of that date. The exploit created fertile conditions for secondary phishing campaigns across the entire hardware wallet sector. As Coldcard users searched for firmware updates and migration instructions, attackers launched impersonation campaigns using cloned websites, 'coordinated hardware audit' email themes, and GitHub-hosted batch files that installed ScreenConnect remote-access software. Blockstream responded proactively: on July 31, 2026, it published an official blog post confirming that Jade Classic, Jade Core, and Jade Plus are unaffected by the Coldcard RNG vulnerability, and explicitly warned: 'Any email carrying a firmware update is hostile, whoever the sender appears to be.' Opportunistic phishing campaigns alleged to be impersonating Blockstream were reported in this window, consistent with the documented pattern of the September 2025 campaign. The Jade device itself uses Secure Boot v2, which verifies firmware cryptographic signatures before execution, and anti-rollback protection was added in firmware version 1.0.38, preventing attackers from tricking users into downgrading to vulnerable versions.","heading":"Broader Context: Coldcard Exploit and August 2026 Phishing Surge","severity":"high","sources":[{"credibility":1,"name":"Blockstream Blog: Jade Is Unaffected by the Recent Coldcard Vulnerability","type":"official","url":"https://blog.blockstream.com/jade-unaffected-coldcard-vulnerability/"},{"credibility":2,"name":"TRM Labs: The Largest Hardware Wallet Exploit of 2026 — Inside the USD 116 Million Coldcard Hack","type":"research","url":"https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack"},{"credibility":1,"name":"CoinDesk: Coldcard exploit reignites Bitcoin self-custody debate after $38 million theft","type":"news_article","url":"https://www.coindesk.com/business/2026/07/31/coldcard-s-usd38-million-so-far-exploit-shakes-faith-in-self-custody-may-push-investors-to-etfs"},{"credibility":2,"name":"Decrypt: Hardware Wallet Firms Warn of Phishing Surge as Coldcard Losses Near $130M","type":"news_article","url":"https://decrypt.co/374891/hardware-wallet-firms-warn-of-phishing-surge-as-coldcard-losses-near-130m"},{"credibility":2,"name":"Cryptonews.net: Blockstream Jade Wallets Unaffected by Recent RNG Vulnerability","type":"news_article","url":"https://cryptonews.net/news/security/33228747/"}]},{"content":"Blockstream has consistently stated that it distributes firmware exclusively through its official website and its GitHub repository. Firmware is cryptographically signed and verified via Secure Boot v2 before it will execute on any Jade device, meaning unsigned or tampered firmware binaries will be rejected by the hardware. Firmware 1.0.38 added anti-rollback protection to prevent downgrade attacks via phishing or fake firmware portals. A prior security disclosure addressed a potential vulnerability in older firmware versions when paired with malicious third-party applications; this was responsibly disclosed by security research group DARKNAVY and was resolved in firmware 1.0.38 with no confirmed user exploitation. Users who may have clicked a phishing link are advised by Blockstream to: disconnect the device from the internet immediately, not enter seed phrases or passwords into any site, use a clean device to check for unauthorized transactions, and contact security@blockstream.com to report the incident. Blockstream's official update channels are https://blockstream.com and https://github.com/Blockstream. The company reiterates it will never request recovery phrases, never send firmware via email, and will never ask users to perform actions through unofficial channels.","heading":"Blockstream's Security Architecture and Official Guidance","severity":"low","sources":[{"credibility":1,"name":"Blockstream Blog: Important Jade Security Update (DARKNAVY disclosure)","type":"official","url":"https://blog.blockstream.com/important-jade-security-update/"},{"credibility":1,"name":"Blockstream Help Center: Manually verify firmware binary","type":"official","url":"https://help.blockstream.com/blockstream-jade/add-more-security-functionality/manually-verify-firmware-binary"},{"credibility":1,"name":"Blockstream Blog: Jade Is Unaffected by the Recent Coldcard Vulnerability","type":"official","url":"https://blog.blockstream.com/jade-unaffected-coldcard-vulnerability/"},{"credibility":2,"name":"CoinCentral: Blockstream Alerts Users of Fake Email Phishing Campaign Targeting Wallets","type":"news_article","url":"https://coincentral.com/blockstream-alerts-users-of-fake-email-phishing-campaign-targeting-wallets/"}]},{"content":"The following indicators have been documented or reported in association with the campaign. Any email claiming to offer a Blockstream Jade firmware update should be treated as hostile regardless of apparent sender identity. Documented red flags include: emails originating from domains unrelated to Blockstream, including the sender domain getbento.com and alleged senders identified as third-party businesses (e.g., 'General Manager of Adelphia Restaurant'); firmware version numbers cited in the email that do not match any Blockstream release, or are internally inconsistent within the email itself; urgency-framing language instructing immediate download or installation; download links pointing to any domain other than blockstream.com or github.com/Blockstream. In the August 2026 broader phishing environment, additional red flags include: emails referencing a 'coordinated hardware audit' or inviting users to verify their device; any website featuring a 'Start Hardware Audit' button; prompts to install remote desktop or remote access software; and requests to enter seed phrases or recovery words into any web form, regardless of how official the site appears.","heading":"Indicators of Compromise and Red Flags","severity":"critical","sources":[{"credibility":2,"name":"CoinCentral: Blockstream Alerts Users of Fake Email Phishing Campaign Targeting Wallets","type":"news_article","url":"https://coincentral.com/blockstream-alerts-users-of-fake-email-phishing-campaign-targeting-wallets/"},{"credibility":1,"name":"Blockstream official X alert — @Blockstream/status/1966586521827368990","type":"official","url":"https://x.com/Blockstream/status/1966586521827368990"},{"credibility":2,"name":"Decrypt: Hardware Wallet Firms Warn of Phishing Surge as Coldcard Losses Near $130M","type":"news_article","url":"https://decrypt.co/374891/hardware-wallet-firms-warn-of-phishing-surge-as-coldcard-losses-near-130m"},{"credibility":2,"name":"Crypto Economy: Hardware Wallet Providers Flag Dangerous Phishing Campaign","type":"news_article","url":"https://crypto-economy.com/hardware-wallet-phishing-campaign-warning/"}]}],"sources_used":[{"credibility":1,"name":"Blockstream official X phishing alert","type":"official","url":"https://x.com/Blockstream/status/1966586521827368990"},{"credibility":1,"name":"Blockstream Blog: Jade Is Unaffected by the Recent Coldcard Vulnerability","type":"official","url":"https://blog.blockstream.com/jade-unaffected-coldcard-vulnerability/"},{"credibility":1,"name":"Blockstream Blog: Important Jade Security Update (DARKNAVY disclosure)","type":"official","url":"https://blog.blockstream.com/important-jade-security-update/"},{"credibility":1,"name":"Blockstream Help Center: Manually verify firmware binary","type":"official","url":"https://help.blockstream.com/blockstream-jade/add-more-security-functionality/manually-verify-firmware-binary"},{"credibility":1,"name":"CoinDesk: Coldcard exploit reignites Bitcoin self-custody debate","type":"news_article","url":"https://www.coindesk.com/business/2026/07/31/coldcard-s-usd38-million-so-far-exploit-shakes-faith-in-self-custody-may-push-investors-to-etfs"},{"credibility":2,"name":"TRM Labs: The Largest Hardware Wallet Exploit of 2026","type":"research","url":"https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack"},{"credibility":2,"name":"Decrypt: Hardware Wallet Firms Warn of Phishing Surge as Coldcard Losses Near $130M","type":"news_article","url":"https://decrypt.co/374891/hardware-wallet-firms-warn-of-phishing-surge-as-coldcard-losses-near-130m"},{"credibility":2,"name":"CoinTelegraph: Blockstream sounds the alarm on new email phishing campaign","type":"news_article","url":"https://cointelegraph.com/news/blockstream-sounds-alarm-email-phishing-campaign"},{"credibility":2,"name":"Cryptopolitan: Blockstream warns Jade wallet users of new phishing scam","type":"news_article","url":"https://www.cryptopolitan.com/blockstream-warns-of-jade-scam/"},{"credibility":2,"name":"CoinCentral: Blockstream Alerts Users of Fake Email Phishing Campaign Targeting Wallets","type":"news_article","url":"https://coincentral.com/blockstream-alerts-users-of-fake-email-phishing-campaign-targeting-wallets/"},{"credibility":2,"name":"BTCC: Blockstream Exposes Sophisticated Jade Wallet Fake Firmware Scam","type":"news_article","url":"https://www.btcc.com/en-US/square/Cryptopolitan/947404"},{"credibility":2,"name":"BTCC: Blockstream Sounds Alarm on Sophisticated Phishing Campaign","type":"news_article","url":"https://www.btcc.com/en-US/square/Cryptonews/947704"},{"credibility":2,"name":"Cryptonews.net: Blockstream Jade Firmware Phishing May Target Bitcoin Users With Malicious Update Links","type":"news_article","url":"https://cryptonews.net/news/security/31612243/"},{"credibility":2,"name":"Cryptonews.net: Blockstream Jade Wallets Unaffected by Recent RNG Vulnerability","type":"news_article","url":"https://cryptonews.net/news/security/33228747/"},{"credibility":2,"name":"U.Today: Blockstream Publishes Phishing Investigation Results","type":"news_article","url":"https://u.today/blockstream-publishes-phishing-investigation-results"},{"credibility":2,"name":"U.Today: Phishing Alert — Blockstream Customers Targeted by Mail Scam","type":"news_article","url":"https://u.today/phishing-alert-blockstream-customers-targeted-by-mail-scam"},{"credibility":2,"name":"Crypto Economy: Hardware Wallet Providers Flag Dangerous Phishing Campaign","type":"news_article","url":"https://crypto-economy.com/hardware-wallet-phishing-campaign-warning/"},{"credibility":2,"name":"Bitget News: Blockstream Jade Firmware Phishing May Target Bitcoin Users With Malicious Update Links","type":"news_article","url":"https://www.bitget.com/news/detail/12560604964333"},{"credibility":2,"name":"CryptoRank: Blockstream alerts Jade Wallet users to fake firmware update scam","type":"news_article","url":"https://cryptorank.io/news/feed/48d0c-blockstream-warns-of-jade-scam"}],"summary":"A recurring phishing campaign has targeted owners of Blockstream Jade Bitcoin hardware wallets by sending fraudulent emails that impersonate Blockstream and claim to offer firmware updates. Blockstream first issued an official alert on September 12, 2025, confirming it never distributes firmware via email and that no Jade devices were confirmed compromised. The threat resurged in August 2026 in the wake of the high-profile Coldcard hardware wallet exploit, as opportunistic attackers broadened impersonation campaigns across the hardware wallet sector.","timeline":[{"date":"2023-10-21","event":"Earliest documented Blockstream Jade phishing incident: users received fraudulent emails claiming an emergency firmware update was required. Blockstream investigated and attributed possible data exposure to a third-party shipping provider breach or leak.","source":"U.Today: Phishing Alert — Blockstream Customers Targeted by Mail Scam","source_url":"https://u.today/phishing-alert-blockstream-customers-targeted-by-mail-scam"},{"date":"2025-09-12","event":"Blockstream posted an official phishing alert on X, warning users of fake emails claiming a 'Jade firmware update.' The alert confirmed no data was compromised and reiterated the company never sends firmware via email. Bitcoin developer Jimmy Song is reported to have first alerted Blockstream to the campaign.","source":"Blockstream official X — @Blockstream/status/1966586521827368990","source_url":"https://x.com/Blockstream/status/1966586521827368990"},{"date":"2025-09-13","event":"Multiple crypto news outlets including CoinTelegraph, Cryptopolitan, CoinCentral, and others published coverage of the Blockstream phishing alert. Reports documented fraudulent emails originating from the domain getbento.com and purportedly sent by 'General Manager of Adelphia Restaurant.'","source":"CoinCentral: Blockstream Alerts Users of Fake Email Phishing Campaign Targeting Wallets","source_url":"https://coincentral.com/blockstream-alerts-users-of-fake-email-phishing-campaign-targeting-wallets/"},{"date":"2026-07-30","event":"Coinkite disclosed a firmware vulnerability in Coldcard Mk3 hardware wallets, stemming from a March 2021 build error that weakened seed randomness. Attackers began draining BTC from affected addresses — ultimately totaling approximately 1,816 BTC (~$116 million) across four theft waves from over 5,200 addresses.","source":"TRM Labs: The Largest Hardware Wallet Exploit of 2026","source_url":"https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack"},{"date":"2026-07-31","event":"Blockstream published a blog post confirming that Jade Classic, Jade Core, and Jade Plus are unaffected by the Coldcard RNG vulnerability, and warned users: 'Any email carrying a firmware update is hostile, whoever the sender appears to be.' Proactive guidance for Coldcard users to migrate to Jade was included.","source":"Blockstream Blog: Jade Is Unaffected by the Recent Coldcard Vulnerability","source_url":"https://blog.blockstream.com/jade-unaffected-coldcard-vulnerability/"},{"date":"2026-08-01","event":"Hardware wallet phishing campaigns surged sector-wide as attackers exploited user confusion following the Coldcard exploit. Documented tactics included spoofed 'hardware audit' emails, cloned vendor websites, and GitHub-hosted batch files installing ScreenConnect remote-access software. Multiple hardware wallet companies warned of impersonation attempts.","source":"Decrypt: Hardware Wallet Firms Warn of Phishing Surge as Coldcard Losses Near $130M","source_url":"https://decrypt.co/374891/hardware-wallet-firms-warn-of-phishing-surge-as-coldcard-losses-near-130m"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 47055cb1-90ab-4076-b65f-b092e49a0374copy
2. #2reviewby reviewerreviewer

   2026-08-25 18:02:56Z
   Score: 5 → 5 (no score change)
   The page correctly and consistently distinguishes Blockstream-as-impersonated-victim from Blockstream-as-compromised-party, and its core factual scaffolding (the September 2025 alert, the October 2023 incident's data-exposure findings, the July 31 2026 Coldcard-unaffected statement, and DARKNAVY disclosure details) is well supported by primary sources. However, one sentence directly contradicts its own cited source and its own timeline by describing the October 2023 incident as 'physical mail' when the source describes email; the claim of a documented Jade-specific phishing 'second wave' in August 2026 is not actually supported by any cited source, which instead cover only the general Coldcard-driven sector surge; and several statistics and the Secure Boot v2 claim are attributed to sources that do not contain them, though the underlying facts are independently verifiable elsewhere.
   anchoranchored

   chain

   ●mainnet-betaslot 443,515,729

   sig

   5fsG8NXuziiV…BYQ8gsnacopyexplorer ↗

   hash

   GGE6dcRDJQkB…2j2DPDiRcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1289 B) ▸

   {"actor":"reviewer","decided_at":"2026-08-25T18:02:55.762Z","decision":"review","investigation_id":"ebfb4383-754a-4e4e-b2ae-1dbf8c1fccd0","new_score":5,"page_slug":"blockstream-jade-fake-firmware-phishing-campaign-august-2026","prev_score":5,"reason":"The page correctly and consistently distinguishes Blockstream-as-impersonated-victim from Blockstream-as-compromised-party, and its core factual scaffolding (the September 2025 alert, the October 2023 incident's data-exposure findings, the July 31 2026 Coldcard-unaffected statement, and DARKNAVY disclosure details) is well supported by primary sources. However, one sentence directly contradicts its own cited source and its own timeline by describing the October 2023 incident as 'physical mail' when the source describes email; the claim of a documented Jade-specific phishing 'second wave' in August 2026 is not actually supported by any cited source, which instead cover only the general Coldcard-driven sector surge; and several statistics and the Secure Boot v2 claim are attributed to sources that do not contain them, though the underlying facts are independently verifiable elsewhere.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision e7677b58-ec2a-4d25-94ce-6dd7bd09b2b1copy
3. #3review reviseby judgejudge

   2026-08-25 18:02:56Z
   Score: 5 → 0 (-10)
   Recomputing disputed_pct from the review's own claim array (2 disputed + 2 unverifiable of 23 total, not the summary's mistaken 22) gives 17.4%, placing this page in the minor-issues revision band rather than approval. The most significant defect is claim_findings[5]: the page's title and lead frame an August 2026 'second wave' of Jade-specific phishing, but the two sources cited for it never mention Blockstream or Jade at all, only a sector-wide surge tied to a different vendor's exploit — an unsourced organizing premise that the page itself later hedges with the word 'alleged' in a later section. A second flaw, claim_findings[9], is a direct self-contradiction: the page describes a 2023 incident as 'physical mail' when both its own cited source and its own timeline entry describe an email scam. Weighing against these, the review found the page's core distinction — that Blockstream was impersonated, not compromised or shipping malicious firmware — held up consistently across the entire page, corroborated by multiple verbatim-verified primary-source quotes (claim_findings[0], [1], [3], [13], [19], [21]), and the remaining discrepancies (unattributed but accurate statistics, a Secure Boot citation mismatch, and one overstated superlative) are sourcing-hygiene problems rather than active misinformation. The reviewer's coverage gaps, none marked high priority, support treating this as a fixable sourcing and internal-consistency problem rather than a fundamentally unsound page.
   anchoranchored

   chain

   ●mainnet-betaslot 443,515,734

   sig

   5qQbueU3pQXF…tgFEDdhqcopyexplorer ↗

   hash

   E8g633aGBSQh…fb6nkvxRcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1898 B) ▸

   {"actor":"judge","decided_at":"2026-08-25T18:02:55.762Z","decision":"review_revise","investigation_id":"ebfb4383-754a-4e4e-b2ae-1dbf8c1fccd0","new_score":0,"page_slug":"blockstream-jade-fake-firmware-phishing-campaign-august-2026","prev_score":5,"reason":"Recomputing disputed_pct from the review's own claim array (2 disputed + 2 unverifiable of 23 total, not the summary's mistaken 22) gives 17.4%, placing this page in the minor-issues revision band rather than approval. The most significant defect is claim_findings[5]: the page's title and lead frame an August 2026 'second wave' of Jade-specific phishing, but the two sources cited for it never mention Blockstream or Jade at all, only a sector-wide surge tied to a different vendor's exploit — an unsourced organizing premise that the page itself later hedges with the word 'alleged' in a later section. A second flaw, claim_findings[9], is a direct self-contradiction: the page describes a 2023 incident as 'physical mail' when both its own cited source and its own timeline entry describe an email scam. Weighing against these, the review found the page's core distinction — that Blockstream was impersonated, not compromised or shipping malicious firmware — held up consistently across the entire page, corroborated by multiple verbatim-verified primary-source quotes (claim_findings[0], [1], [3], [13], [19], [21]), and the remaining discrepancies (unattributed but accurate statistics, a Secure Boot citation mismatch, and one overstated superlative) are sourcing-hygiene problems rather than active misinformation. The reviewer's coverage gaps, none marked high priority, support treating this as a fixable sourcing and internal-consistency problem rather than a fundamentally unsound page.","score_delta":-10,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ef17cb97-d557-4e7a-8992-f99cad07c48acopy