Audit log

Every state-changing event for Chainflip: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-09-17 12:18:08Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 447,793,401

   sig

   5zBXFMybhJwC…86BaRkAbcopyexplorer ↗

   hash

   9xojnRhJw5UQ…MuPSDDLScopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (14662 B) ▸

   {"actor":"system:backfill","investigation_id":"48b42a99-3bbe-4bc7-8910-0d744aa21dc0","kind":"publish","page_slug":"chainflip","published_at":"2026-09-17T12:18:08.199Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Chainflip","sections":[{"content":"Chainflip is a decentralized cross-chain swap protocol founded in 2020 as a spin-out from the Oxen project by Simon Harman (CEO), Chris McCabe (co-founder and COO of Oxen), Martin Rieke (CTO), and Alicia Hatt (CFO). The protocol is built around a two-layer architecture: a Substrate-based State Chain that acts as an accounting and coordination layer, and validator-controlled Vault contracts on each supported chain that custody assets. Validators use Multi-Party Computation and Threshold Signature Schemes (TSS) to authorize outbound transactions without any single party holding a private key. Swaps are matched through a Just-In-Time (JIT) AMM modeled on Uniswap v3 and executed virtually on the State Chain. The protocol's native token is FLIP. As of reporting, Chainflip had processed over $6 billion in cumulative swap volume across supported chains including Bitcoin, Ethereum, Solana, and TRON.","heading":"Protocol Overview","severity":"low","sources":[{"credibility":1,"name":"Chainflip Protocol Overview — Official Documentation","type":"official","url":"https://docs.chainflip.io/protocol/protocol-overview"},{"credibility":1,"name":"What is Chainflip? The Complete Guide to Native Cross-Chain Swaps","type":"official","url":"https://chainflip.io/blog/what-is-chainflip-complete-guide"},{"credibility":2,"name":"Chorus One: Network 101 — A concise guide to Chainflip","type":"research","url":"https://chorus.one/articles/network-101-a-concise-guide-to-chainflip-and-how-it-simplifies-cross-chain-swaps"}]},{"content":"Between approximately 01:44 and 03:10 UTC on September 12, 2026, an attacker exploited a flaw in Chainflip's TRON USDT integration, draining 736,442.17 USDT across six unauthorized payouts in approximately 90 minutes. The attacker made eight attempts in total; two did not result in unauthorized payouts.\n\nThe exploit targeted Chainflip's memo-parsing logic for TRON transfers. TRON's transaction format allows an optional memo field that Chainflip used to carry swap routing instructions. According to Chainflip's public disclosure, the attacker submitted a transaction that validators had already signed and appended a malformed memo. Chainflip's monitoring software interpreted the memo as a separate, failed swap instruction and issued a refund — while the original deposit had already generated a standard withdrawal payout. This created a duplicate-payment condition that the attacker repeated across eight attempts, with each successive attempt approximately doubling in size.\n\nChainflip confirmed that the vulnerability was internal to its own memo-processing code and was not caused by a flaw in TRON or Tether. All other supported chains and remaining vault funds were described as unaffected. An additional 115,654.41 USDT from a pending swap remained stuck in Chainflip's vault and was not paid out to the attacker.\n\nFollowing discovery, Chainflip paused all network-wide swap and quoting operations and notified what it described as 'relevant parties' about the stolen funds, though it did not publicly identify those parties or confirm whether centralized exchanges had been contacted to freeze proceeds.","heading":"September 2026 TRON USDT Memo Exploit","severity":"critical","sources":[{"credibility":2,"name":"Chainflip loses 736,442 USDT in TRON exploit — crypto.news","type":"news_article","url":"https://crypto.news/chainflip-loses-736442-usdt-in-tron-exploit/"},{"credibility":2,"name":"Chainflip Halts Network After $736K Tron USDT Exploit; Users to Be Made Whole — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/09/13/chainflip-halts-network-after-736k-tron-usdt-exploit-users-to-be-made-whole/"},{"credibility":2,"name":"Chainflip Loses $736K in TRON USDT Memo Exploit, Pauses Network-Wide Swaps — Blockfence","type":"news_article","url":"https://blockfence.io/chainflip-loses-736k-in-tron-usdt-memo-exploit-pauses-network-wide-swaps/"},{"credibility":2,"name":"Chainflip Hack on Tron: Check Your USDT Swap Now — CryptoTicker","type":"news_article","url":"https://cryptoticker.io/en/chainflip-tron-exploit-check-swap/"}]},{"content":"Upon detecting the exploit, Chainflip paused all swap routes across the entire network. The team patched the vulnerability by restricting which TRON transfers are permitted to carry swap instructions in their memo fields. Network operations — excluding the TRON route — reportedly resumed by September 16, 2026.\n\nAs part of its recovery plan, Chainflip announced it would reset all affected liquidity providers' active TRON USDT balances to zero. Before executing the reset, the protocol committed to recording each provider's pre-migration balance in a separate on-chain ledger entry, preserving a verifiable record of the amounts owed. The 115,654.41 USDT pending swap that remained locked in the vault was identified as potentially recoverable.\n\nChainflip confirmed the flaw was limited to the TRON USDT integration path. No attacker identity, transaction hashes, or destination wallet addresses had been publicly disclosed as of the time of reporting.","heading":"Emergency Response and Network Restart","severity":"high","sources":[{"credibility":2,"name":"Chainflip to reset TRON USDT provider balances to zero following $736,000 exploit — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/chainflip-to-reset-tron-usdt-provider-balances-to-zero-following-736000-exploit/"},{"credibility":2,"name":"Chainflip Halts Network After $736K Tron USDT Exploit; Users to Be Made Whole — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/09/13/chainflip-halts-network-after-736k-tron-usdt-exploit-users-to-be-made-whole/"},{"credibility":2,"name":"Chainflip to Reset TRON USDT Provider Balances to Zero After $736,000 Exploit — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/chainflip-to-reset-tron-usdt-provider-balances-to-zero-after-736-000-exploit"}]},{"content":"Chainflip has publicly committed to making all affected liquidity providers whole following the September 12 exploit. As of the most recent reporting, the protocol had not disclosed the specific funding source for reimbursement — options referenced in coverage included treasury assets, protocol revenue, or an insurance-style buffer — nor had it published a payment timeline.\n\nA complete technical post-mortem was promised following the safe restart of the network, which was targeted for September 16, 2026 at the earliest. As of the date of this investigation (September 17, 2026), no full post-mortem had been publicly confirmed as published. The on-chain record of pre-migration balances was described as the mechanism by which providers can verify what they are owed while awaiting reimbursement.\n\nThe 115,654.41 USDT stuck in the vault from the pending swap was noted as potentially recoverable, though its disposition had not been confirmed. No regulatory filings or law enforcement referrals were publicly announced in connection with the incident.","heading":"Compensation and Post-Mortem Status","severity":"high","sources":[{"credibility":2,"name":"Chainflip to reset TRON USDT provider balances to zero following $736,000 exploit — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/chainflip-to-reset-tron-usdt-provider-balances-to-zero-following-736000-exploit/"},{"credibility":2,"name":"Chainflip loses 736,442 USDT in TRON exploit — crypto.news","type":"news_article","url":"https://crypto.news/chainflip-loses-736442-usdt-in-tron-exploit/"},{"credibility":2,"name":"Chainflip Puts TRON Exploit Loss at $736K — CoinInsider","type":"news_article","url":"https://www.coininsider.org/news/chainflip-puts-tron-exploit-loss-at-736k/"}]},{"content":"The September 2026 exploit exposed a class of vulnerability inherent to cross-chain protocols that rely on transaction metadata fields — such as memos, calldata, or reference tags — to carry routing instructions. TRON's memo field is an optional, user-controlled string attached to transfers. Chainflip's ingestion layer interpreted this field as an authoritative swap instruction without sufficient validation of whether the memo corresponded to a new, legitimate deposit or a replay of an already-processed transaction.\n\nThe duplicate-payment outcome — where a single deposit generates both a normal payout and an additional refund triggered by a malformed memo — is consistent with a time-of-check/time-of-use (TOCTOU) class of logic error in asynchronous cross-chain settlement systems. Chainflip's stated fix was to restrict which TRON transfers are permitted to carry memo-based swap instructions, narrowing the attack surface but leaving broader questions about the robustness of its ingestion validation layer across other supported chains unanswered pending a full post-mortem.\n\nNo independent security audit findings related to this specific vector had been publicly cited at the time of reporting.","heading":"Design Risk: Cross-Chain Memo Handling","severity":"high","sources":[{"credibility":2,"name":"Chainflip loses 736,442 USDT in TRON exploit — crypto.news","type":"news_article","url":"https://crypto.news/chainflip-loses-736442-usdt-in-tron-exploit/"},{"credibility":2,"name":"Chainflip Loses $736K in TRON USDT Memo Exploit, Pauses Network-Wide Swaps — Blockfence","type":"news_article","url":"https://blockfence.io/chainflip-loses-736k-in-tron-usdt-memo-exploit-pauses-network-wide-swaps/"}]}],"sources_used":[{"credibility":2,"name":"Chainflip loses 736,442 USDT in TRON exploit — crypto.news","type":"news_article","url":"https://crypto.news/chainflip-loses-736442-usdt-in-tron-exploit/"},{"credibility":2,"name":"Chainflip to reset TRON USDT provider balances to zero following $736,000 exploit — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/chainflip-to-reset-tron-usdt-provider-balances-to-zero-following-736000-exploit/"},{"credibility":2,"name":"Chainflip Halts Network After $736K Tron USDT Exploit; Users to Be Made Whole — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/09/13/chainflip-halts-network-after-736k-tron-usdt-exploit-users-to-be-made-whole/"},{"credibility":2,"name":"Chainflip Loses $736K in TRON USDT Memo Exploit, Pauses Network-Wide Swaps — Blockfence","type":"news_article","url":"https://blockfence.io/chainflip-loses-736k-in-tron-usdt-memo-exploit-pauses-network-wide-swaps/"},{"credibility":2,"name":"Chainflip Hack on Tron: Check Your USDT Swap Now — CryptoTicker","type":"news_article","url":"https://cryptoticker.io/en/chainflip-tron-exploit-check-swap/"},{"credibility":2,"name":"Chainflip Puts TRON Exploit Loss at $736K — CoinInsider","type":"news_article","url":"https://www.coininsider.org/news/chainflip-puts-tron-exploit-loss-at-736k/"},{"credibility":2,"name":"Chainflip to Reset TRON USDT Provider Balances to Zero After $736,000 Exploit — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/chainflip-to-reset-tron-usdt-provider-balances-to-zero-after-736-000-exploit"},{"credibility":1,"name":"Chainflip Protocol Overview — Official Documentation","type":"official","url":"https://docs.chainflip.io/protocol/protocol-overview"},{"credibility":1,"name":"What is Chainflip? The Complete Guide to Native Cross-Chain Swaps — Chainflip Blog","type":"official","url":"https://chainflip.io/blog/what-is-chainflip-complete-guide"},{"credibility":2,"name":"Chorus One: Network 101 — A concise guide to Chainflip","type":"research","url":"https://chorus.one/articles/network-101-a-concise-guide-to-chainflip-and-how-it-simplifies-cross-chain-swaps"}],"summary":"Chainflip is a decentralized cross-chain swap protocol that uses a validator network, threshold signature schemes, and a Substrate-based State Chain to facilitate native asset swaps across blockchains without wrapped tokens or bridges. On September 12, 2026, an attacker exploited a flaw in Chainflip's TRON USDT memo-handling logic, triggering duplicate payouts across six transactions totaling 736,442.17 USDT over approximately 90 minutes. Chainflip halted the entire network, patched the vulnerability, and committed to making affected liquidity providers whole, though the specific reimbursement mechanism and a complete technical post-mortem remained pending as of the time of reporting.","timeline":[{"date":"2020-01-01","event":"Chainflip Labs founded as a spin-out from the Oxen project by Simon Harman and Chris McCabe.","source":"Bybit Learn — What is Chainflip (FLIP)?","source_url":"https://learn.bybit.com/en/defi/what-is-chainflip-flip"},{"date":"2026-09-12","event":"Attacker begins exploiting TRON USDT memo-handling vulnerability between approximately 01:44 and 03:10 UTC. Eight attempts are made; six succeed, draining 736,442.17 USDT across approximately 90 minutes. One pending swap of 115,654.41 USDT remains stuck in the vault.","source":"crypto.news — Chainflip loses 736,442 USDT in TRON exploit","source_url":"https://crypto.news/chainflip-loses-736442-usdt-in-tron-exploit/"},{"date":"2026-09-12","event":"Chainflip detects the exploit and pauses all network-wide swap and quoting operations. The team notifies unspecified 'relevant parties' about the stolen funds.","source":"CryptoTimes — Chainflip Halts Network After $736K Tron USDT Exploit","source_url":"https://www.cryptotimes.io/2026/09/13/chainflip-halts-network-after-736k-tron-usdt-exploit-users-to-be-made-whole/"},{"date":"2026-09-13","event":"Chainflip publishes incident disclosure. Confirms exploit was limited to TRON USDT route, all other funds secure, and commits to making affected users whole. Announces plan to reset TRON USDT provider balances to zero while recording owed amounts separately on-chain.","source":"CryptoSlate — Chainflip to reset TRON USDT provider balances to zero","source_url":"https://cryptoslate.com/chainflip-to-reset-tron-usdt-provider-balances-to-zero-following-736000-exploit/"},{"date":"2026-09-16","event":"Chainflip reports that swap and quoting operations have resumed across the network, with TRON excluded pending full recovery. TRON USDT provider balance migration and reimbursement process remain ongoing.","source":"CryptoSlate — Chainflip to reset TRON USDT provider balances to zero","source_url":"https://cryptoslate.com/chainflip-to-reset-tron-usdt-provider-balances-to-zero-following-736000-exploit/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 2041661b-071f-4e64-a7d6-3c53493a28bbcopy