Audit log

Every state-changing event for ChangeNOW: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-17 23:44:51Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   AURRWLRTePU7…pSpehshbcopysha256 → base58

   verifying row…

   canonical bytes (20254 B) ▸

   {"actor":"system:backfill","investigation_id":"4363d267-d270-468c-a37f-ca36b140d556","kind":"publish","page_slug":"changenow","published_at":"2026-08-17T23:44:51.122Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"ChangeNOW","sections":[{"content":"ChangeNOW has operated since 2017 as a non-custodial instant cryptocurrency exchange. The legal entity is CHN Group LLC, incorporated in Saint Vincent and the Grenadines, with a registered address at Euro House, Richmond Hill Road, Kingstown, Saint Vincent and the Grenadines. The company also maintains an operational address in Tallinn, Estonia. As a non-custodial service, ChangeNOW does not hold user funds; transactions are processed directly between counterparties without the platform taking custody. The company reports serving approximately 10 million users and processing more than 50,000 daily exchanges across 1,000+ cryptocurrencies on 110+ blockchains. It also operates a B2B API program with reportedly over 5,000 integration partners.","heading":"Overview and Corporate Structure","severity":"low","sources":[{"credibility":2,"name":"ChangeNOW About Page","type":"official","url":"https://changenow.io/about"},{"credibility":2,"name":"ChangeNOW Attorney Request Guidelines","type":"official","url":"https://changenow.io/attorney-request-guidelines"}]},{"content":"ChangeNOW does not require account registration or mandatory identity verification for most crypto-to-crypto swaps. Fiat-currency transactions and certain flagged activities trigger a KYC requirement applied through third-party providers, including Sumsub, which the company states are compliant with GDPR and Financial Action Task Force (FATF) standards. The platform's published AML/CFT compliance documentation, version 1.9, states that its framework is based on the FATF 40 Recommendations. Automated transaction monitoring using blockchain analytics tools — including Crystal Intelligence and AML Bot — is described as the primary screening layer. When the automated system flags a transaction as suspicious, the exchange is paused and the customer is prompted to verify their identity before the swap proceeds. ChangeNOW's incorporation jurisdiction, Saint Vincent and the Grenadines, does not require a specific financial services license for this type of operation, meaning the company is not subject to the licensing and examination regime applicable to exchanges registered in the EU, UK, or US. This jurisdictional choice limits external regulatory oversight of its compliance program.","heading":"KYC and AML Policy","severity":"medium","sources":[{"credibility":2,"name":"ChangeNOW AML/KYC Policy","type":"official","url":"https://changenow.io/terms-of-use/aml-kyc"},{"credibility":2,"name":"ChangeNOW AML/CFT Compliance Rules PDF","type":"official","url":"https://changenow.io/files/Rules_of_AML_CFT_compliance_ChangeNow.v1.9.pdf"},{"credibility":2,"name":"ChangeNOW KYC/AML FAQ","type":"official","url":"https://changenow.io/faq/kyc-aml-procedure"},{"credibility":2,"name":"ChangeNOW Review 2026 — CEX.IO University","type":"research","url":"https://university.cex.io/changenow-review/"}]},{"content":"ChangeNOW has been identified by blockchain security researchers as a routing point for stolen funds in at least two confirmed major exploits in 2026, within a roughly three-month window.\n\nGravity Bridge exploit (May 2026): On or around May 29–30, 2026, Cosmos-based cross-chain protocol Gravity Bridge lost approximately $5.4 million in a suspected validator signing-key compromise. Stolen assets included approximately $4.3 million in USDC, 274 ETH (~$553,000), $434,000 in USDT, and additional tokens. Security firm PeckShield reported that part of the stolen funds had already been laundered through ChangeNOW and Binance before investigators published their alert. As of the initial reporting, the exploiter was still holding approximately 2,102 ETH (~$4.23 million). ChangeNOW's specific response to this incident, if any, has not been confirmed in available public sources.\n\nCoinsbuy hack (August 2026): On August 9, 2026, crypto payments processor Coinsbuy had wallets drained of more than $7.9 million across the Ethereum and TRON networks. On-chain monitoring firm Specter detected the outflows and published an alert. PeckShield identified ChangeNOW as one of three platforms — alongside FixedFloat and BingX — through which stolen funds were routed, as attackers attempted to convert proceeds into Monero. According to blockchain investigator Specter and multiple outlets reporting on the incident, ChangeNOW reportedly froze a six-figure portion of the proceeds, limiting the full scope of the outflow. ChangeNOW had not issued a separate public statement confirming the exact frozen sum as of the time of initial reporting. The majority of funds from this hack remain unrecovered.\n\nThe repeated appearance of ChangeNOW in post-exploit laundering flows is consistent with a broader pattern in which instant, no-registration swap services are used to quickly convert stolen assets into harder-to-trace tokens before funds reach other exchanges. ChangeNOW is not unique in this role among non-custodial swap services, but its frequency of appearance across confirmed 2026 incidents is a material risk signal. No claim of deliberate facilitation has been made by any researcher, and no enforcement action has been filed against ChangeNOW in connection with either incident.","heading":"Appearance in Post-Exploit Fund Flows (2026)","severity":"high","sources":[{"credibility":2,"name":"Cosmos-based Gravity Bridge drained of $5.4 million — The Block","type":"news_article","url":"https://www.theblock.co/post/403108/cosmos-based-gravity-bridge-drained-of-5-4-million-in-suspected-key-compromise-researchers-say"},{"credibility":2,"name":"Gravity Bridge Drained of $5.4 Million as Hacker Routes Stolen Funds Through Binance — Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/gravity-bridge-exploit-5-4-million-binance-changenow-2026/"},{"credibility":2,"name":"Gravity Bridge Loses $5.4 Million in Suspected Signing Key Compromise — BeInCrypto","type":"news_article","url":"https://beincrypto.com/gravity-bridge-hack-key-compromise-5m/"},{"credibility":2,"name":"Coinsbuy confirms hack as investigator reports $7.9M stolen — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/coinsbuy-confirms-security-breach-after-wallets-reportedly-drained-of-79m"},{"credibility":2,"name":"Coinsbuy Wallets Drained For Over $7.9 Million on Ethereum and Tron — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/08/10/coinsbuy-wallets-drained-for-over-7-9-million-on-ethereum-and-tron/"},{"credibility":2,"name":"Coinsbuy Faces Reported $7.9 Million Crypto Hack — BeInCrypto","type":"news_article","url":"https://beincrypto.com/coinsbuy-hack-crypto-august/"},{"credibility":2,"name":"Coinsbuy hit by reported $7.9M Ethereum, TRON drain — Crypto.news","type":"news_article","url":"https://crypto.news/coinsbuy-hit-by-reported-7-9m-ethereum-tron-drain/"}]},{"content":"ChangeNOW publicly documents a history of cooperation with law enforcement agencies across more than 70 jurisdictions. Its asset-recovering page and published security reports describe several cases where the company froze funds mid-transfer and returned them in coordination with police or investigative agencies. Documented cases include: a September 2023 recovery of 10.6 BTC (approximately $430,000) related to a SIM swap hack; recovery of $210,000 from a fraudulent Uniswap app incident in cooperation with Romanian law enforcement; recovery of $100,000 in Bitcoin through partnership with AQ Forensics; and a $44,500 HBAR recovery assisted by the FBI. The company states it has recovered over $19 million from fraud-related losses in total across its operational history. The freeze of a six-figure portion of Coinsbuy hack proceeds in August 2026 is consistent with this documented pattern of reactive cooperation. ChangeNOW's attorney request guidelines describe a structured framework for processing law enforcement and legal requests, with processing times of 3 to 20 business days and a requirement for court orders before personally identifiable or KYC data is disclosed. The company states it does not retain frozen assets and does not profit from fraud.","heading":"Law Enforcement Cooperation and Asset Recovery Track Record","severity":"low","sources":[{"credibility":2,"name":"ChangeNOW Asset Recovering and User Protection Page","type":"official","url":"https://changenow.io/asset-recovering"},{"credibility":2,"name":"ChangeNOW Safety Report — $275k Stolen Funds Recovered","type":"official","url":"https://changenow.io/blog/safety-report-stolen-funds-returned"},{"credibility":2,"name":"How ChangeNOW Combats Fraudulent Crypto Activity — CoinCarp","type":"news_article","url":"https://www.coincarp.com/learn/how-changenow-combat-fraudulent-crypto-activity/"},{"credibility":2,"name":"ChangeNOW Attorney Request Guidelines","type":"official","url":"https://changenow.io/attorney-request-guidelines"}]},{"content":"As of August 2026, no confirmed regulatory enforcement action by any government body — including the SEC, CFTC, FinCEN, OFAC, or any EU or UK regulator — has been filed against ChangeNOW. The company operates under a non-custodial model and is incorporated in Saint Vincent and the Grenadines, a jurisdiction that does not require a specific exchange license for this type of service. This structure means ChangeNOW is not subject to routine regulatory examination, and the absence of enforcement action cannot be treated as a finding of compliance. The company's published AML/CFT framework references FATF standards and GDPR, but there is no third-party audit of that framework in available public sources. The platform's recurrent appearance in post-exploit fund flows may attract increased regulatory scrutiny as global AML standards for non-custodial services continue to evolve under FATF Travel Rule guidance. In August 2026, ChangeNOW co-published a financial privacy report with CoinRabbit arguing that crypto privacy tools serve essential protective functions and that privacy and compliance are not a zero-sum trade-off. This public positioning is relevant context for understanding the company's stance on the friction its no-registration model creates for forensic investigators.","heading":"Regulatory Status and Jurisdictional Risk","severity":"medium","sources":[{"credibility":2,"name":"ChangeNOW Compliance Statement — How to Stay Safe","type":"official","url":"https://changenow.io/blog/maintaining-legal-compliance-and-security-a-statement-from-changenow-compliance-team"},{"credibility":2,"name":"Crypto Privacy Tools Serve Essential Protective Functions — Decrypt","type":"news_article","url":"https://decrypt.co/374838/crypto-privacy-tools-serve-essential-protective-functions-report-by-changenow-coinrabbit"},{"credibility":2,"name":"ChangeNOW and CoinRabbit Release Joint Research on Financial Privacy — Chainwire","type":"news_article","url":"https://chainwire.org/2026/08/04/changenow-and-coinrabbit-release-joint-research-on-financial-privacy-in-digital-assets/"},{"credibility":1,"name":"OFAC Civil Penalties and Enforcement Information","type":"regulatory","url":"https://ofac.treasury.gov/civil-penalties-and-enforcement-information"}]},{"content":"ChangeNOW's core product design — instant swaps with no mandatory account registration — creates a structural characteristic that reduces friction for all users, including those moving stolen funds. This is not unique to ChangeNOW; many non-custodial instant swap services share this design. However, the platform's scale (reportedly 50,000+ daily exchanges, 5,000+ API partners) and multi-chain coverage amplify the surface area available to exploit. Post-exploit laundering flows frequently use instant swap services to convert identifiable tokens (e.g., ETH, USDC) into harder-to-trace assets or privacy coins (e.g., Monero) before funds reach centralized exchanges. The Coinsbuy hack investigators identified ChangeNOW alongside FixedFloat and BingX in this conversion-chain role. The adoption of Monero's FCMP++ protocol upgrade, expected in a 2026 hard fork, has been flagged by observers as a development that may further limit the effectiveness of mid-transfer freezes like the one ChangeNOW executed in the Coinsbuy incident. ChangeNOW's compliance infrastructure — including automated transaction screening and law enforcement cooperation — represents a genuine mitigation, but its reactive nature means a portion of illicit flows will complete conversion before any freeze can be applied.","heading":"Structural Risk: No-Registration Model as Laundering Vector","severity":"high","sources":[{"credibility":2,"name":"Hackers Drain $7.9M From Coinsbuy; Monero Upgrade Kills Last Forensic Fallback — TechTimes","type":"news_article","url":"https://www.techtimes.com/articles/323701/20260810/hackers-drain-79m-coinsbuy-monero-upgrade-kills-last-forensic-fallback.htm"},{"credibility":2,"name":"Coinsbuy Suffers Hack, Over $7.9 Million Stolen — KuCoin News","type":"news_article","url":"https://www.kucoin.com/news/flash/coinsbuy-suffers-hack-over-7-9m-stolen-in-ethereum-and-tron"}]}],"sources_used":[{"credibility":2,"name":"Cosmos-based Gravity Bridge drained of $5.4 million — The Block","type":"news_article","url":"https://www.theblock.co/post/403108/cosmos-based-gravity-bridge-drained-of-5-4-million-in-suspected-key-compromise-researchers-say"},{"credibility":2,"name":"Gravity Bridge Drained of $5.4 Million as Hacker Routes Stolen Funds Through Binance — Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/gravity-bridge-exploit-5-4-million-binance-changenow-2026/"},{"credibility":2,"name":"Gravity Bridge Loses $5.4 Million in Suspected Signing Key Compromise — BeInCrypto","type":"news_article","url":"https://beincrypto.com/gravity-bridge-hack-key-compromise-5m/"},{"credibility":2,"name":"Coinsbuy confirms hack as investigator reports $7.9M stolen — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/coinsbuy-confirms-security-breach-after-wallets-reportedly-drained-of-79m"},{"credibility":2,"name":"Coinsbuy Wallets Drained For Over $7.9 Million on Ethereum and Tron — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/08/10/coinsbuy-wallets-drained-for-over-7-9-million-on-ethereum-and-tron/"},{"credibility":2,"name":"Coinsbuy Faces Reported $7.9 Million Crypto Hack — BeInCrypto","type":"news_article","url":"https://beincrypto.com/coinsbuy-hack-crypto-august/"},{"credibility":2,"name":"Coinsbuy hit by reported $7.9M Ethereum, TRON drain — Crypto.news","type":"news_article","url":"https://crypto.news/coinsbuy-hit-by-reported-7-9m-ethereum-tron-drain/"},{"credibility":2,"name":"Hackers Drain $7.9M From Coinsbuy; Monero Upgrade Kills Last Forensic Fallback — TechTimes","type":"news_article","url":"https://www.techtimes.com/articles/323701/20260810/hackers-drain-79m-coinsbuy-monero-upgrade-kills-last-forensic-fallback.htm"},{"credibility":2,"name":"Coinsbuy Faces Reported $7.9 Million Crypto Hack — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/coinsbuy-faces-reported-7-9-055403041.html"},{"credibility":2,"name":"Crypto Privacy Tools Serve Essential Protective Functions — Decrypt","type":"news_article","url":"https://decrypt.co/374838/crypto-privacy-tools-serve-essential-protective-functions-report-by-changenow-coinrabbit"},{"credibility":2,"name":"ChangeNOW and CoinRabbit Release Joint Research — Chainwire","type":"news_article","url":"https://chainwire.org/2026/08/04/changenow-and-coinrabbit-release-joint-research-on-financial-privacy-in-digital-assets/"},{"credibility":2,"name":"ChangeNOW About Page","type":"official","url":"https://changenow.io/about"},{"credibility":2,"name":"ChangeNOW AML/KYC Policy","type":"official","url":"https://changenow.io/terms-of-use/aml-kyc"},{"credibility":2,"name":"ChangeNOW AML/CFT Compliance Rules v1.9","type":"official","url":"https://changenow.io/files/Rules_of_AML_CFT_compliance_ChangeNow.v1.9.pdf"},{"credibility":2,"name":"ChangeNOW Asset Recovering and User Protection Page","type":"official","url":"https://changenow.io/asset-recovering"},{"credibility":2,"name":"ChangeNOW Safety Report — $275k Stolen Funds Recovered","type":"official","url":"https://changenow.io/blog/safety-report-stolen-funds-returned"},{"credibility":2,"name":"ChangeNOW Attorney Request Guidelines","type":"official","url":"https://changenow.io/attorney-request-guidelines"},{"credibility":2,"name":"How ChangeNOW Combats Fraudulent Crypto Activity — CoinCarp","type":"news_article","url":"https://www.coincarp.com/learn/how-changenow-combat-fraudulent-crypto-activity/"},{"credibility":2,"name":"ChangeNOW Review 2026 — CEX.IO University","type":"research","url":"https://university.cex.io/changenow-review/"},{"credibility":2,"name":"ChangeNOW Crypto Exchange — TradingFinder","type":"research","url":"https://tradingfinder.com/exchanges/changenow/"}],"summary":"ChangeNOW is a non-custodial, KYC-optional instant cryptocurrency swap service founded in 2017 and operated by CHN Group LLC, incorporated in Saint Vincent and the Grenadines. The platform supports swaps across more than 1,000 crypto assets without mandatory account registration, a design that has made it a recurrent node in post-exploit fund flows. In 2026 alone, stolen funds from two confirmed major hacks — the Gravity Bridge $5.4 million exploit (May 2026) and the Coinsbuy $7.9 million theft (August 2026) — were reportedly routed through ChangeNOW, though no regulatory enforcement action has been taken against the company as of August 2026.","timeline":[{"date":"2017-01-01","event":"ChangeNOW founded and launched as an instant cryptocurrency swap service.","source":"ChangeNOW About Page","source_url":"https://changenow.io/about"},{"date":"2023-09-01","event":"ChangeNOW cooperates with law enforcement to recover 10.6 BTC (~$430,000) from a SIM swap hack victim, one of the first publicly documented large-scale recovery cases.","source":"How ChangeNOW Combats Fraudulent Crypto Activity — CoinCarp","source_url":"https://www.coincarp.com/learn/how-changenow-combat-fraudulent-crypto-activity/"},{"date":"2026-05-29","event":"Gravity Bridge cross-chain protocol suffers a suspected validator signing-key compromise, losing approximately $5.4 million. Security researchers report that a portion of stolen funds was routed through ChangeNOW and Binance.","source":"Cosmos-based Gravity Bridge drained of $5.4 million — The Block","source_url":"https://www.theblock.co/post/403108/cosmos-based-gravity-bridge-drained-of-5-4-million-in-suspected-key-compromise-researchers-say"},{"date":"2026-08-04","event":"ChangeNOW and CoinRabbit co-publish a financial privacy report arguing that crypto privacy tools serve essential protective functions and are compatible with compliance requirements.","source":"Crypto Privacy Tools Serve Essential Protective Functions — Decrypt","source_url":"https://decrypt.co/374838/crypto-privacy-tools-serve-essential-protective-functions-report-by-changenow-coinrabbit"},{"date":"2026-08-09","event":"Coinsbuy crypto payments platform wallets drained of over $7.9 million across Ethereum and TRON. Attackers route a portion of funds through ChangeNOW, FixedFloat, and BingX in an attempt to convert proceeds into Monero.","source":"Coinsbuy confirms hack as investigator reports $7.9M stolen — CoinTelegraph","source_url":"https://cointelegraph.com/news/coinsbuy-confirms-security-breach-after-wallets-reportedly-drained-of-79m"},{"date":"2026-08-10","event":"Reporting confirms that ChangeNOW froze a six-figure portion of the Coinsbuy hack proceeds mid-transfer, per blockchain investigator Specter. ChangeNOW had not issued a separate public statement confirming the exact amount as of initial reporting.","source":"Coinsbuy Wallets Drained For Over $7.9 Million on Ethereum and Tron — CryptoTimes","source_url":"https://www.cryptotimes.io/2026/08/10/coinsbuy-wallets-drained-for-over-7-9-million-on-ethereum-and-tron/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d9e721d3-c54c-4097-bc4e-fe7015a4caddcopy