Audit log

Every state-changing event for CoinStats: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-28 03:59:57Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,643,187

   sig

   5Zzf6FSsocYT…YagfL9Zpcopyexplorer ↗

   hash

   5NMqca22rKwb…hAMvCFVhcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6906 B) ▸

   {"actor":"system:backfill","investigation_id":"de664b96-0a0a-4793-b5fe-64c80e308658","kind":"publish","page_slug":"coinstats","published_at":"2026-05-28T03:59:57.141Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"CoinStats","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://legelata.am/armenian-startup-coinstats-raised-3-2-million/","type":"other","url":""},{"credibility":3,"name":"https://tracxn.com/d/companies/coinstats/__neWRsQPS1LXU_Vdg5HVQS00dVtH9kGnfI-KWacM6xKU","type":"other","url":""},{"credibility":3,"name":"https://www.bleepingcomputer.com/news/cryptocurrency/coinstats-says-north-korean-hackers-breached-1-590-crypto-wallets/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://coinstats.app/blog/security-incident-report/","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/coinstats-hack-social-engineering-attack","type":"other","url":""},{"credibility":3,"name":"https://www.bleepingcomputer.com/news/cryptocurrency/coinstats-says-north-korean-hackers-breached-1-590-crypto-wallets/","type":"other","url":""},{"credibility":3,"name":"https://www.securityweek.com/hackers-steal-over-2-million-in-cryptocurrency-from-coinstats-wallets/","type":"other","url":""},{"credibility":3,"name":"https://cryptoslate.com/coinstats-suspends-app-after-security-breach-compromises-1590-wallets/","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/coinstats-security-breach-crypto-wallets-hacked/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.bitget.com/news/detail/12560604061545","type":"other","url":""},{"credibility":3,"name":"https://www.financemagnates.com/trending/coinstats-hack-the-2-million-crypto-heist-that-left-traders-reeling/","type":"other","url":""},{"credibility":3,"name":"https://www.binance.com/en/square/post/2024-06-23-coinstats-app-attacked-hackers-steal-and-sell-mkr-tokens-9840683146137","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://coinstats.app/blog/security-incident-report/","type":"other","url":""},{"credibility":3,"name":"https://www.bleepingcomputer.com/news/cryptocurrency/coinstats-says-north-korean-hackers-breached-1-590-crypto-wallets/","type":"other","url":""},{"credibility":3,"name":"https://www.bitdefender.com/en-us/blog/hotforsecurity/coinstats-breach-state-sponsored-hackers-to-blame-for-stealing-funds-from-approx-1-600-user-accounts","type":"other","url":""},{"credibility":3,"name":"https://www.securityweek.com/hackers-steal-over-2-million-in-cryptocurrency-from-coinstats-wallets/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cointelegraph.com/news/coinstats-hack-1m-eth-transferred-tornado-cash","type":"other","url":""},{"credibility":3,"name":"https://secret3.com/news/hackers-launder-1m-in-ether-through-tornado-cash-after-coinstats-exploit/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://coinstats.app/blog/security-incident-report/","type":"other","url":""},{"credibility":3,"name":"https://www.bleepingcomputer.com/news/cryptocurrency/coinstats-says-north-korean-hackers-breached-1-590-crypto-wallets/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://coinstats.app/blog/security-incident-report/","type":"other","url":""},{"credibility":3,"name":"https://www.financemagnates.com/trending/coinstats-hack-the-2-million-crypto-heist-that-left-traders-reeling/","type":"other","url":""},{"credibility":3,"name":"http://help.coinstats.app/en/articles/6453281-protect-yourself-from-potential-scams","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"http://help.coinstats.app/en/articles/6453281-protect-yourself-from-potential-scams","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cryptoslate.com/products/coinstats/","type":"other","url":""},{"credibility":3,"name":"https://play.google.com/store/apps/details?id=com.coinstats.crypto.portfolio","type":"other","url":""}]}],"sources_used":[],"summary":"CoinStats is an Armenian-founded cryptocurrency portfolio tracking application with approximately 1.5 million users, founded in 2017 by Narek Gevorgyan. On June 22, 2024, the platform suffered a significant security breach in which 1,590 internally-hosted wallets were compromised and approximately $2.2 million in cryptocurrency was stolen, with attribution pointing to North Korea's Lazarus Group. The platform has since rebuilt its infrastructure and restored operations, but no confirmed compensation program for affected users has been publicly documented.","timeline":[{"date":"2017-01-01","event":"CoinStats founded in Yerevan, Armenia by Narek Gevorgyan as a personal crypto portfolio tracking tool.","source":""},{"date":"2021-01-01","event":"CoinStats reports 1.2 million monthly active users and sixfold revenue growth; raises $3.2 million in early funding.","source":""},{"date":"2024-06-22","event":"Security breach detected at approximately 18:00 UTC. Attackers gain access to AWS infrastructure and HashiCorp Vault via a socially engineered employee. 1,590 internal wallets compromised. Malicious push notification sent to iOS users directing them to a drainer site. Platform taken offline.","source":""},{"date":"2024-06-22","event":"Blurr.eth's wallet drained of 3,657 MKR tokens (~$8.7M). Hacker liquidates MKR on-chain, causing a 7% MKR price drop.","source":""},{"date":"2024-06-22","event":"CoinStats publicly discloses breach via X (Twitter) and urges users with internally-created wallets to transfer funds immediately.","source":""},{"date":"2024-06-24","event":"CoinStats partially restores platform operations with enhanced security measures.","source":""},{"date":"2024-06-25","event":"On-chain analysts observe approximately 211 ETH (~$1M) transferred from attacker wallets to Tornado Cash mixer.","source":""},{"date":"2024-07-03","event":"CoinStats announces full platform restoration; all functionalities operational.","source":""},{"date":"2024-07-12","event":"CoinStats publishes formal security incident report attributing attack to Lazarus Group or a related nation-state actor. Reports $2.2M in total losses across 1,590 wallets. Announces victim registration form with August 15 deadline for compensation eligibility consideration.","source":""},{"date":"2024-08-15","event":"Deadline for affected users to submit information to CoinStats for potential future compensation consideration.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 473c13d2-bb51-4e76-8af4-adb939a9e59fcopy
2. #2rescoreby systemsystem

   2026-10-10 18:47:42Z
   Score: 35 → 56 (+21)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 35 → 56. Problems weighed by who is responsible: incidents the subject suffered −12.8, problems around the subject, caused by others −3.2, concerns that are not fraud −3.2; legitimacy credit long-running +10.
   anchoranchored

   chain

   ●mainnet-betaslot 455,367,655

   sig

   4Tg2GUBRVCK2…ra97GqDKcopyexplorer ↗

   hash

   5pM4SMphMJ8h…i4xgvSzgcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (642 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:47:42.606Z","decision":"rescore","investigation_id":"de664b96-0a0a-4793-b5fe-64c80e308658","new_score":56,"page_slug":"coinstats","prev_score":35,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 35 → 56. Problems weighed by who is responsible: incidents the subject suffered −12.8, problems around the subject, caused by others −3.2, concerns that are not fraud −3.2; legitimacy credit long-running +10.","score_delta":21,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 1c312315-8ed5-4793-a510-8129f08dafaecopy
3. #3reviewby reviewerreviewer

   2026-11-02 10:20:28Z
   Score: 56 → 56 (no score change)
   The core breach facts (June 22, 2024; 1,590 wallets; 1.3%; about $2.2M; Lazarus attribution as CoinStats' belief) are well corroborated. Errors are in the Tornado Cash section: the amount is 311 ETH (about $959k), not 211 ETH, and Tornado Cash is described as currently sanctioned although OFAC delisted it on 2025-03-21. The funding figure is internally inconsistent and unsourced, and the FBI involvement and compensation claims could not be verified. No evidence of shutdown or new incident was found.
   anchoranchored

   chain

   ●mainnet-betaslot 464,459,652

   sig

   L3Tuyxvjg3yH…se2zv2F4copyexplorer ↗

   hash

   J4NpjBS8Lkes…nGaedyEzcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1316 B) ▸

   {"actor":"reviewer","artifact_identity":"eaced05e511d85b5f6bc5fba13284414","decided_at":"2026-11-02T10:20:28.429Z","decision":"review","disputed_pct":0.5556,"findings_hash":"BVZHjEjtAwUQaLyyZkxhVVNDnxiZfUekFh6H67zxbJk2","investigation_id":"de664b96-0a0a-4793-b5fe-64c80e308658","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":56,"page_content_hash":"a6da542175f7e072d939e6fa3a69016d9f43a0a54a3d9df7b19515214550b71f","page_slug":"coinstats","prev_score":56,"reason":"The core breach facts (June 22, 2024; 1,590 wallets; 1.3%; about $2.2M; Lazarus attribution as CoinStats' belief) are well corroborated. Errors are in the Tornado Cash section: the amount is 311 ETH (about $959k), not 211 ETH, and Tornado Cash is described as currently sanctioned although OFAC delisted it on 2025-03-21. The funding figure is internally inconsistent and unsourced, and the FBI involvement and compensation claims could not be verified. No evidence of shutdown or new incident was found.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":3,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ce145b48-c176-4fce-97e1-59412f8c7338copy
4. #4review reviseby judgejudge

   2026-11-02 10:20:28Z
   Score: 56 → 56 (no score change)
   The core breach facts (June 22, 2024 incident, 1,590 wallets, 1.3% of hosted wallets, about $2.2M stolen) were confirmed by independent reporting (claim_findings[4]). However, 5 of 9 reviewed claims were disputed or could not be verified: the Tornado Cash amount is 311 ETH (about $959K) rather than 211 ETH (claim_findings[0], [1]), the $4.4M funding figure conflicts with the page's own $3.2M figure and has no source (claim_findings[5]), and the Blurr.eth MKR loss and the no-compensation statement were not verified (claim_findings[6], [7]). Tornado Cash is also described as currently sanctioned although OFAC delisted it in March 2025 (claim_findings[2]). The errors sit in secondary details rather than the central allegation, and the reviewer's confidence is moderate, so the penalty is set in the lower half of the band.
   anchoranchored

   chain

   ●mainnet-betaslot 464,459,657

   sig

   67hMWTsd2D7R…GvSZoaSccopyexplorer ↗

   hash

   CXoQAC33tRHN…hmRT3HvXcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1472 B) ▸

   {"actor":"judge","artifact_identity":"eaced05e511d85b5f6bc5fba13284414","band_override":null,"decided_at":"2026-11-02T10:20:28.429Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.5556,"investigation_id":"de664b96-0a0a-4793-b5fe-64c80e308658","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":56,"page_slug":"coinstats","prev_score":56,"reason":"The core breach facts (June 22, 2024 incident, 1,590 wallets, 1.3% of hosted wallets, about $2.2M stolen) were confirmed by independent reporting (claim_findings[4]). However, 5 of 9 reviewed claims were disputed or could not be verified: the Tornado Cash amount is 311 ETH (about $959K) rather than 211 ETH (claim_findings[0], [1]), the $4.4M funding figure conflicts with the page's own $3.2M figure and has no source (claim_findings[5]), and the Blurr.eth MKR loss and the no-compensation statement were not verified (claim_findings[6], [7]). Tornado Cash is also described as currently sanctioned although OFAC delisted it in March 2025 (claim_findings[2]). The errors sit in secondary details rather than the central allegation, and the reviewer's confidence is moderate, so the penalty is set in the lower half of the band.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision a324afd9-b7c5-4b69-82bd-0ff2a66cebe2copy
5. #5rescoreby systemsystem

   2026-11-02 10:20:29Z
   Score: 56 → 63 (+7)
   Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 56 → 63. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −3.2, problems around the subject, caused by others −2.4; legitimacy credit long-running +10; 3 section(s) set aside until a failed fact-check is resolved.
   anchoranchored

   chain

   ●mainnet-betaslot 464,459,662

   sig

   4jYtaz9ogB8A…vnBm1HTZcopyexplorer ↗

   hash

   5TS4KfyfHWpE…EKvDGeC9copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (751 B) ▸

   {"actor":"system","decided_at":"2026-11-02T10:20:28.429Z","decision":"rescore","investigation_id":"de664b96-0a0a-4793-b5fe-64c80e308658","new_score":63,"page_slug":"coinstats","prev_score":56,"reason":"Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 56 → 63. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −3.2, problems around the subject, caused by others −2.4; legitimacy credit long-running +10; 3 section(s) set aside until a failed fact-check is resolved.","score_delta":7,"score_model":"v2","sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 2d09af63-af33-4344-bfb0-596e39682999copy