Audit log

Every state-changing event for DarkSword (iOS Safari zero-click exploit chain targeting crypto wallets): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1reviewby reviewerreviewer

   2026-10-27 10:59:42Z
   Score: 3 → 3 (no score change)
   The core technical facts hold: the six CVEs, the March 2026 GTIG disclosure, activity since November 2025, and the April 1 release of iOS 18.7.7. The September SlowMist claims are hedged appropriately, and no confirmed theft is documented. Problems found: the named apps (Coinbase, Binance, Ledger, MetaMask) come from Lookout, not the cited Hacker News and GTIG pages. The actor attributions are wrongly described as resting on a single research note, since they come from GTIG. The stated reason for the 18.7.7 backport contradicts TechCrunch, and the late-March limited rollout is not in that article. The SlowMist lure-domain details could not be checked because the advisory was blocked. The page omits the October 2026 Censys report.
   anchoranchored

   chain

   ●mainnet-betaslot 462,045,598

   sig

   2sV7xnoracvP…ugpQKfUkcopyexplorer ↗

   hash

   6xH7bLSL4qQh…XHB5h7AYcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1683 B) ▸

   {"actor":"reviewer","artifact_identity":"4ceb56d69b669091bcd8d2dff3521cf0","blocked_count":1,"decided_at":"2026-10-27T10:59:42.474Z","decision":"review","disputed_pct":0.2222,"findings_hash":"58q69eFSXreTrM9rUfC4ndyXtZVwoe6gJxz1rVgxr6VN","investigation_id":"398c8634-edab-4f6a-8f3d-ca0abc756f59","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":3,"omissions":{"material":1,"total":2},"page_content_hash":"f0a1d8d533014058172f69f0efc855f88ff54a8f7dfea3f9549bea4db17b9970","page_slug":"darksword-ios-safari-zero-click-exploit-chain-targeting-crypto-wallets","prev_score":3,"reason":"The core technical facts hold: the six CVEs, the March 2026 GTIG disclosure, activity since November 2025, and the April 1 release of iOS 18.7.7. The September SlowMist claims are hedged appropriately, and no confirmed theft is documented. Problems found: the named apps (Coinbase, Binance, Ledger, MetaMask) come from Lookout, not the cited Hacker News and GTIG pages. The actor attributions are wrongly described as resting on a single research note, since they come from GTIG. The stated reason for the 18.7.7 backport contradicts TechCrunch, and the late-March limited rollout is not in that article. The SlowMist lure-domain details could not be checked because the advisory was blocked. The page omits the October 2026 Censys report.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":9,"sequence_num":1,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 507f3a8f-f6c2-4eb1-9366-f46488c44630copy
2. #2review reviseby judgejudge

   2026-10-27 10:59:42Z
   Score: 3 → 0 (-12)
   Of 10 claims checked, 1 could not be read because the source blocked the reviewer and was left out, and 2 of the remaining 9 were disputed (about 22%). claim_findings[3] shows the actor attributions come from Google's Threat Intelligence Group, not a single research note as the page says. claim_findings[5] shows the reason given for the iOS 18.7.7 backport is the opposite of what the cited TechCrunch article reports. Named wallet apps are credited to the wrong sources (claim_findings[1] and [2]), and the page omits the October 2026 Censys report of continued wallet targeting (omission_findings[0]). The core facts hold: the six CVEs, the March 2026 disclosure, the April 1 patch release, and the careful hedging on unconfirmed fund theft.
   anchoranchored

   chain

   ●mainnet-betaslot 462,045,603

   sig

   4TFS53bCH9Vr…FVen3avecopyexplorer ↗

   hash

   65aUgMaK1BeC…VNRJVtiucopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1897 B) ▸

   {"actor":"judge","artifact_identity":"4ceb56d69b669091bcd8d2dff3521cf0","band_override":null,"blocked_count":1,"decided_at":"2026-10-27T10:59:42.474Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.2222,"investigation_id":"398c8634-edab-4f6a-8f3d-ca0abc756f59","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":0,"page_slug":"darksword-ios-safari-zero-click-exploit-chain-targeting-crypto-wallets","prev_score":3,"reason":"Of 10 claims checked, 1 could not be read because the source blocked the reviewer and was left out, and 2 of the remaining 9 were disputed (about 22%). claim_findings[3] shows the actor attributions come from Google's Threat Intelligence Group, not a single research note as the page says. claim_findings[5] shows the reason given for the iOS 18.7.7 backport is the opposite of what the cited TechCrunch article reports. Named wallet apps are credited to the wrong sources (claim_findings[1] and [2]), and the page omits the October 2026 Censys report of continued wallet targeting (omission_findings[0]). The core facts hold: the six CVEs, the March 2026 disclosure, the April 1 patch release, and the careful hedging on unconfirmed fund theft.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":-12,"scored_claims":9,"sequence_num":2,"severity_override":{"applied":true,"band":"minor","from_band":"minor","reason":"omission_findings[0] is a material omission: the October 2026 Censys report of continued DarkSword/Coruna wallet targeting is not on the page, which stops at September. This does not contradict the page and the report names no victims, so it moves the penalty to the upper part of the minor band rather than into a harsher band."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 698c162b-d0bd-4df0-b0f4-3cfd6070f54bcopy
3. #3reviewby reviewerreviewer

   2026-11-02 08:38:12Z
   Score: 0 → 0 (no score change)
   The core technical, attribution and patch claims match GTIG's primary post, and the October 2026 Macworld and BlockTempo claims match those articles. One issue: the TechCrunch quote about a GitHub leak and Apple's quarter-of-devices estimate does not appear in the cited April 1 article and seems to come from a March 23 TechCrunch piece. The page is carefully hedged on 'zero-click' and on the absence of confirmed thefts. No critical omissions found.
   anchoranchored

   chain

   ●mainnet-betaslot 464,430,983

   sig

   4wukHpN9vbbm…8UBwmwCmcopyexplorer ↗

   hash

   DWuCV5erA3sD…9wHCgd9fcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1355 B) ▸

   {"actor":"reviewer","artifact_identity":"7709a096d820cb3c5253c4de95b0a589","decided_at":"2026-11-02T08:38:12.313Z","decision":"review","disputed_pct":0,"findings_hash":"5Sjjm71EWstWRs5ZEm77Uw6iYp5TcbkKFT4uutVuom6Y","investigation_id":"398c8634-edab-4f6a-8f3d-ca0abc756f59","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":0,"omissions":{"material":0,"total":1},"page_content_hash":"9d5caddfa8e6b1712b1568f9cfe0afab3efa6f51f02bbca1604dbcdf265f211a","page_slug":"darksword-ios-safari-zero-click-exploit-chain-targeting-crypto-wallets","prev_score":0,"reason":"The core technical, attribution and patch claims match GTIG's primary post, and the October 2026 Macworld and BlockTempo claims match those articles. One issue: the TechCrunch quote about a GitHub leak and Apple's quarter-of-devices estimate does not appear in the cited April 1 article and seems to come from a March 23 TechCrunch piece. The page is carefully hedged on 'zero-click' and on the absence of confirmed thefts. No critical omissions found.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":3,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 22e17f4a-6d0c-426e-8a88-1e2fc73bdb9dcopy
4. #4review approveby judgejudge

   2026-11-02 08:38:12Z
   Score: 0 → 3 (+3)
   Of 11 claims checked, 9 were confirmed and 2 were partially supported; none were disputed or unverifiable, so the disputed share is 0%. The core technical, attribution and patch claims match Google's primary threat-intelligence post (claim_findings[0-3], [8]), and the October 2026 Macworld and BlockTempo claims match those articles (claim_findings[4-5]). One citation issue remains: the TechCrunch quote about the GitHub leak and Apple's quarter-of-devices estimate seems to come from a March 23 article rather than the cited April 1 one (claim_findings[6]), and should be corrected. The one omission found (the reported commercial sale of the kit) is minor, and the subject is still active as the page says.
   anchoranchored

   chain

   ●mainnet-betaslot 464,430,988

   sig

   3oHxKq275jAQ…iNfprJxRcopyexplorer ↗

   hash

   32BwiBdp2Zmg…LXArhv1Ecopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1473 B) ▸

   {"actor":"judge","artifact_identity":"7709a096d820cb3c5253c4de95b0a589","band_override":null,"decided_at":"2026-11-02T08:38:12.313Z","decision":"review_approve","delist_requested":false,"disputed_pct":0,"investigation_id":"398c8634-edab-4f6a-8f3d-ca0abc756f59","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":3,"page_slug":"darksword-ios-safari-zero-click-exploit-chain-targeting-crypto-wallets","prev_score":0,"reason":"Of 11 claims checked, 9 were confirmed and 2 were partially supported; none were disputed or unverifiable, so the disputed share is 0%. The core technical, attribution and patch claims match Google's primary threat-intelligence post (claim_findings[0-3], [8]), and the October 2026 Macworld and BlockTempo claims match those articles (claim_findings[4-5]). One citation issue remains: the TechCrunch quote about the GitHub leak and Apple's quarter-of-devices estimate seems to come from a March 23 article rather than the cited April 1 one (claim_findings[6]), and should be corrected. The one omission found (the reported commercial sale of the kit) is minor, and the subject is still active as the page says.","replaces_fact_checks":{"score_before_fact_checks":3,"undone":1},"reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":3,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 867b3fb7-e04f-4e21-8ce9-dabb62a87926copy