← CarbonVote Tokenreviewed 2026-10-16 · 24 claims checked
Fact-check findings
What an automated fact-checker found when it re-read CarbonVote Token against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
6 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #7[disputed][awaiting moderator]in section: Use as Fraudulent Collateral and Exploit Execution
“The Drift official recovery update of April 16, 2026 itemizes the largest components as JLP tokens ($159.3 million), USDC ($71.4 million), cbBTC ($11.3 million), and SOL ($10.4 million) across 26 asset types.”
reviewerThe Drift official recovery update of April 16, 2026 itemizes JLP ($159.3M), USDC ($71.4M), cbBTC ($11.3M), SOL ($10.4M) across 26 asset types.The dollar figures are accurate but the '26 asset types' figure is not supported by the cited source and could not be corroborated by any other source checked.Proposed correction (not yet applied)The Drift official recovery update of April 16, 2026 itemizes the largest components as JLP tokens ($159.3 million), USDC ($71.4 million), cbBTC ($11.3 million), and SOL ($10.4 million) across 19 asset types. - #8[disputed][awaiting moderator]in section: Governance Compromise via Durable Nonce
“On March 27, 2026, Drift migrated its Security Council to a 2-of-5 signature threshold and removed the operational timelock entirely.”
reviewerOn March 27, 2026, Drift migrated its Security Council to a 2-of-5 signature threshold and removed the operational timelock entirely.The page's own cited tier-1 source (Chainalysis) gives March 26, not March 27, for this specific migration. Other outside reporting is split between the two dates, so some ambiguity remains industry-wide, but the page directly contradicts one of its own citations.Proposed correction (not yet applied)On March 26, 2026, Drift migrated its Security Council to a 2-of-5 signature threshold and removed the operational timelock entirely. - #18[disputed][awaiting moderator]in the timeline
“2026-04-02”
reviewerDrift Protocol suspends services and begins publishing incident communications on April 2, 2026; BlockSec, Chainalysis, Elliptic, TRM Labs, and Hypernative publish initial forensic analyses that day.Suspension happened the same day as the exploit (April 1), not April 2, and the cited source does not support the claim that five named firms published analyses that day.Proposed correction (not yet applied)2026-04-01 - #19[disputed][awaiting moderator]in the timeline
“Drift Protocol suspends services and begins publishing incident communications. BlockSec, Chainalysis, Elliptic, TRM Labs, and Hypernative publish initial forensic analyses.”
reviewerDrift Protocol suspends services and begins publishing incident communications; BlockSec, Chainalysis, Elliptic, TRM Labs, and Hypernative publish initial forensic analyses.The claim that five specific firms published analyses on this date is unsupported by the cited source, and at least one of the named firms (BlockSec) published two days later.Proposed correction (not yet applied)Drift Protocol suspends services and begins publishing incident communications. - #20[disputed][awaiting moderator]in the timeline
“Drift Protocol publishes the Incident Recovery Update, confirming total verified losses of $295.7 million across 26 asset types and announcing initial recovery framework structure including Tether's proposed $127.5 million contribution.”
reviewerDrift Protocol publishes the Incident Recovery Update confirming total verified losses of $295.7 million across 26 asset types.Same underlying defect as the section-level claim about 26 asset types.Proposed correction (not yet applied)Drift Protocol publishes the Incident Recovery Update, confirming total verified losses of $295.7 million across 19 asset types and announcing initial recovery framework structure including Tether's proposed $127.5 million contribution. - #21[disputed][awaiting moderator]in the timeline
“2026-03-27”
reviewerOn March 27, 2026, Drift Protocol migrates its Security Council to a 2-of-5 multisig threshold and removes the operational timelock.Same underlying date discrepancy as the section-level claim. Note industry reporting is genuinely split between March 26 and 27 for this event, so some uncertainty remains even after correction.Proposed correction (not yet applied)2026-03-26
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #17[unverifiable][awaiting moderator]in section: Post-Exploit Fund Laundering
“Following the 12-minute drainage on April 1, 2026, stolen assets began moving within approximately 23 minutes of the admin takeover.”
reviewerStolen assets began moving within approximately 23 minutes of the admin takeover.No source consulted states a 23-minute figure; some reporting instead describes bridging/laundering unfolding over several hours, which is in tension with this precise figure.
partially supported
8 claimsThe cited evidence supports part of the claim but not all of it.
- #4[partially supported][awaiting moderator]in section: Oracle Manipulation via Switchboard
“reported across multiple sources as a Switchboard (SwitchboardOnDemand) price feed”
reviewerAn on-chain oracle, reported as a Switchboard (SwitchboardOnDemand) price feed, harvested the fabricated price history.The page hedges correctly ('reported across multiple sources'), and the Switchboard detail does appear in broader reporting (Blockaid), but none of the three sources actually cited in this section name Switchboard directly. - #5[partially supported][awaiting moderator]in section: Oracle Manipulation via Switchboard
“does not evaluate whether an asset has real economic backing—it evaluates the inputs it is given: price feeds, liquidity signals, collateral parameters.”
reviewerHypernative: Drift's oracle system 'does not evaluate whether an asset has real economic backing—it evaluates the inputs it is given: price feeds, liquidity signals, collateral parameters.'Substantively close but the quotation marks claim word-for-word fidelity that isn't accurate; the clause 'and account health' is silently dropped. - #6[partially supported][awaiting moderator]in section: Use as Fraudulent Collateral and Exploit Execution
“The second transaction advanced the durable nonce account and executed an UpdateAdmin instruction transferring Drift's administrative control to an attacker-controlled address reported as H7PiGqqUaanBovwKgEtreJbKmQe6dbq6VTrw6guy7ZgL.”
reviewerAttackers transferred Drift's admin control to an address reported as H7PiGqqUaanBovwKgEtreJbKmQe6dbq6VTrw6guy7ZgL.The address itself checks out — web search confirms Blockaid independently identified H7PiGqqUaanBovwKgEtreJbKmQe6dbq6VTrw6guy7ZgL as the compromised admin address — but none of the four sources cited in this section actually state it, so the claim is accurate yet mis-sourced. - #9[partially supported][awaiting moderator]in section: Governance Compromise via Durable Nonce
“BlockSec notes that the authorization 'occurred at the signing stage, not execution—the on-chain transactions merely materialized previously granted permissions.'”
reviewerBlockSec notes that the authorization 'occurred at the signing stage, not execution—the on-chain transactions merely materialized previously granted permissions.'The substance is accurate but presented with quotation marks implying an exact quote that does not match the source. - #13[partially supported][awaiting moderator]in section: DPRK Attribution (UNC4736 / AppleJeus / Citrine Sleet)
“The Nexus Mutual incident report notes that the individuals who appeared in person at conferences 'were not DPRK nationals' but third-party intermediaries operating under constructed identities.”
reviewerThe Nexus Mutual incident report notes that the individuals who appeared in person at conferences 'were not DPRK nationals' but third-party intermediaries.Substance is directionally right but the quotation is altered and the attribution chain (Drift's claim, relayed by Nexus Mutual) is collapsed into 'the Nexus Mutual incident report notes.' - #16[partially supported][awaiting moderator]in section: Post-Exploit Fund Laundering
“The largest component—approximately $232 million in USDC—was bridged from Solana to Ethereum via Circle's Cross-Chain Transfer Protocol (CCTP) across more than 100 transactions.”
reviewerThe largest component, approximately $232 million in USDC, was bridged via Circle's CCTP across more than 100 transactions.The $232 million CCTP figure is independently correct — on-chain analyst ZachXBT's figure of over $232 million bridged via CCTP is widely reported — but none of the four sources cited in this section state it. - #23[partially supported][awaiting moderator]in section: Recovery Framework and Victim Compensation
“The framework is funded through: Tether's proposed contribution of up to $127.5 million; an additional $20 million from other partners; and a $100 million revenue-linked credit facility.”
reviewerThe recovery framework is funded through Tether's $127.5 million, $20 million from other partners, and a $100 million revenue-linked credit facility; the pool was seeded at $3.8 million; total verified losses are $295.4 million per CoinDesk.The $127.5M/$20M/$3.8M/$295.4M figures are all independently confirmed via CoinDesk. A $100M revenue-linked credit facility is reported elsewhere but sources disagree on whether it is part of or separate from the $127.5M Tether figure, and it is absent from the specific cited CoinDesk article. - #24[partially supported][awaiting moderator]in section: Recovery Framework and Victim Compensation
“Drift's relaunch is conditioned on independent audits by Ottersec and Asymmetric, migration of the settlement layer from USDC to USDT, and implementation of a new community-governed multisig with enforced timelocks.”
reviewerDrift's relaunch is conditioned on independent audits by Ottersec and Asymmetric, migration from USDC to USDT, and a new community-governed multisig with enforced timelocks.OtterSec and Asymmetric audits and the USDC-to-USDT migration are corroborated by other reporting (TheDefiant) found via web search, but not by the cited CoinDesk article; 'community-governed' specifically could not be independently verified.
confirmed
9 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Token Creation and Supply Structure
“CarbonVote Token (CVT) was deployed on the Solana blockchain on March 12, 2026, approximately one day after attackers withdrew 10 ETH from Tornado Cash on March 11 to fund the operation.”
reviewerCarbonVote Token (CVT) was deployed on Solana on March 12, 2026, approximately one day after a 10 ETH Tornado Cash withdrawal on March 11.Both cited tier-1 sources corroborate the date and sequence. - #2[confirmed][no action needed]in section: Token Creation and Supply Structure
“At the time of the exploit, the attacker controlled approximately 80% of the total supply—roughly 600 million tokens—according to Hypernative's post-exploit analysis.”
reviewerThe attacker controlled approximately 80% of CVT's total supply, roughly 600 million of 750 million tokens, per Hypernative.Figures match the cited source exactly. - #3[confirmed][no action needed]in section: Raydium Seeding and Wash Trading
“The Nexus Mutual incident report describes this process as fabricating 'a price history that Drift's oracles would accept.'”
reviewerWash trading fabricated 'a price history that Drift's oracles would accept,' per Nexus Mutual.Direct quote verified verbatim against source. - #10[confirmed][no action needed]in section: Governance Compromise via Durable Nonce
“BlockSec's technical analysis identifies that four durable nonce accounts were created: two tied to legitimate Security Council members and two controlled by the attacker.”
reviewerFour durable nonce accounts were created: two tied to legitimate Security Council members and two controlled by the attacker.Matches cited source closely. - #11[confirmed][no action needed]in section: DPRK Attribution (UNC4736 / AppleJeus / Citrine Sleet)
“TRM Labs and Elliptic have attributed the Drift Protocol exploit to UNC4736, a North Korean state-affiliated threat actor also tracked under the names AppleJeus, Citrine Sleet, Golden Chollima, and Gleaming Pisces.”
reviewerTRM Labs and Elliptic have attributed the exploit to UNC4736, also tracked as AppleJeus, Citrine Sleet, Golden Chollima, and Gleaming Pisces.Full alias set is corroborated by one of the section's own cited sources (The Hacker News). - #12[confirmed][no action needed]in section: DPRK Attribution (UNC4736 / AppleJeus / Citrine Sleet)
“The Hacker News reports attribution at 'medium confidence.'”
reviewerThe Hacker News reports the DPRK attribution at 'medium confidence.'Verbatim match. - #14[confirmed][no action needed]in section: DPRK Attribution (UNC4736 / AppleJeus / Citrine Sleet)
“Elliptic noted this represented 'the eighteenth DPRK-linked act tracked in 2026, with over $300 million stolen so far' at time of publication.”
reviewerElliptic noted this represented 'the eighteenth DPRK-linked act tracked in 2026, with over $300 million stolen so far.'Minor non-substantive paraphrase ('this year' vs 'in 2026') but faithful. - #15[confirmed][no action needed]in section: DPRK Attribution (UNC4736 / AppleJeus / Citrine Sleet)
“on-chain fund flows tracing back to addresses previously associated with the October 2024 Radiant Capital hack, which Mandiant had attributed to UNC4736”
reviewerOn-chain fund flows traced back to addresses associated with the October 2024 Radiant Capital hack, attributed by Mandiant to UNC4736.Accurate, though the original attribution chain runs through Drift's own post-mortem rather than Elliptic's independent work. - #22[confirmed][no action needed]in section: Recovery Framework and Victim Compensation
“Nexus Mutual confirmed that Drift Protocol was not listed on its coverage platform and that no claims resulted from the incident.”
reviewerNexus Mutual confirmed that Drift Protocol was not listed on its coverage platform and that no claims resulted from the incident.Matches source exactly.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.