Audit log

Every state-changing event for DeltaPrime: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-28 03:34:46Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,639,375

   sig

   2nst1FLsyEfb…3eo6FmiAcopyexplorer ↗

   hash

   GHyweNCQQcpN…MiFnvYDxcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6543 B) ▸

   {"actor":"system:backfill","investigation_id":"3b16504a-8f88-41b7-9f56-439fcc2ace96","kind":"publish","page_slug":"deltaprime","published_at":"2026-05-28T03:34:45.950Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"DeltaPrime","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.deltaprime.io/","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/deltaprime","type":"other","url":""},{"credibility":3,"name":"https://docs.deltaprime.io/protocol/the-story-so-far","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-deltaprime-hack-september-2024","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/markets/2024/09/16/crypto-broker-deltaprime-drained-of-over-6m-amid-apparent-private-key-leak","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/delta-prime-defi-hacked-6-m-arbitrum","type":"other","url":""},{"credibility":3,"name":"https://www.merklescience.com/blog/hack-track-deltaprime-flow-of-funds-analysis","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/deltaprime-rekt","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-deltaprime-hack-november-2024","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/delta-prime-exploited-for-4-8-m-worth-of-arb-and-avax","type":"other","url":""},{"credibility":3,"name":"https://threesigma.xyz/blog/exploit/deltaprime-defi-exploit-avalanche-arbitrum-hack","type":"other","url":""},{"credibility":3,"name":"https://www.theblock.co/post/325498/lending-protocol-delta-prime-suffers-second-exploit-in-two-months-bringing-losses-above-10-million","type":"other","url":""},{"credibility":3,"name":"https://www.certik.com/resources/blog/deltaprime-incident-analysis","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cryptoslate.com/deltaprime-hit-by-6m-exploit-amid-north-korea-links-allegations/","type":"other","url":""},{"credibility":3,"name":"https://99bitcoins.com/news/6-million-drained-from-defi-platform-zachxbt-claims-that-north-korea-hackers-may-be-involved/","type":"other","url":""},{"credibility":3,"name":"https://www.cryptonewsz.com/north-korean-behind-deltaprime-attack-5-93m/","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/deltaprime-breach-suspicious-transactions/","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/deltaprime-rekt","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.globenewswire.com/news-release/2024/10/21/2965930/0/en/DeltaPrime-Reimbursement-Plan.html","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/press-release/2024/10/22/deltaprimes-path-to-regrowth-a-robust-plan-to-make-all-affected-users-whole-again","type":"other","url":""},{"credibility":3,"name":"https://medium.com/@DeltaPrimeDefi/deltaprime-post-mortem-reimbursement-plan-07-12-2024-2d654912715b","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/press-releases/deltaprime-reimbursement-plan","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-deltaprime-hack-september-2024","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-deltaprime-hack-november-2024","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/deltaprime","type":"other","url":""},{"credibility":3,"name":"https://www.merklescience.com/blog/hack-track-deltaprime-flow-of-funds-analysis","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://thehackernews.com/2025/06/us-seizes-774m-in-crypto-tied-to-north.html","type":"other","url":""},{"credibility":3,"name":"https://cryptoslate.com/deltaprime-hit-by-6m-exploit-amid-north-korea-links-allegations/","type":"other","url":""}]}],"sources_used":[],"summary":"DeltaPrime is a decentralized leveraged farming and lending protocol deployed on Arbitrum and Avalanche. The protocol suffered two major security exploits in 2024 — a $5.98 million private key compromise in September and a $4.8 million smart contract vulnerability in November — totaling over $10.7 million in losses. On-chain investigator ZachXBT alleged that DeltaPrime had previously employed North Korean IT workers with alleged ties to the DPRK-linked Lazarus Group, raising concerns about insider access as a contributing factor to the first exploit.","timeline":[{"date":"2024-08-15","event":"ZachXBT contacts DeltaPrime and more than 25 other Web3 projects warning them about unknowingly hired DPRK-affiliated IT workers. DeltaPrime reportedly tells ZachXBT the flagged individuals have been removed.","source":""},{"date":"2024-09-16","event":"DeltaPrime's Arbitrum deployment is exploited for approximately $5.98 million via a compromised admin private key. The attacker upgrades proxy contracts to malicious versions and drains DPUSDC, DPARB, and DPBTCb pools. 1,337 ETH is sent to Tornado Cash.","source":""},{"date":"2024-09-16","event":"ZachXBT publicly comments that DeltaPrime was one of the teams warned about DPRK IT workers, and observes laundering patterns similar to the Lazarus Group.","source":""},{"date":"2024-10-21","event":"DeltaPrime publishes its initial reimbursement plan introducing rTKN tokens, with a 1.4x compensation ratio for affected users and a $1.33 million Stability Pool contribution.","source":""},{"date":"2024-11-11","event":"DeltaPrime suffers a second exploit affecting both Arbitrum and Avalanche, losing approximately $4.8 million due to insufficient input validation in the reward claiming smart contract. Total 2024 losses exceed $10.7 million. Protocol pauses all pools.","source":""},{"date":"2024-12-07","event":"DeltaPrime publishes updated post-mortem and reimbursement plan for the second exploit, allocating 33% of future DegenPrime revenue to rTKN reimbursements.","source":""},{"date":"2025-01-01","event":"DeltaPrime 2.0 launches with enhanced security features including a new audit by BlockSec (the protocol's eighth audit).","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 49a25717-f3b3-42de-81e8-422d7623b358copy
2. #2rescoreby systemsystem

   2026-10-10 18:40:19Z
   Score: 22 → 47 (+25)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 22 → 47. Problems weighed by who is responsible: incidents the subject suffered −12.8, concerns that are not fraud −3.2, problems around the subject, caused by others −1.6.
   anchoranchored

   chain

   ●mainnet-betaslot 455,358,636

   sig

   8WN12Cnawi9U…A1Z1AT7Wcopyexplorer ↗

   hash

   zVDu1ZAC2tPw…bCGSkA4Dcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (607 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:40:19.585Z","decision":"rescore","investigation_id":"3b16504a-8f88-41b7-9f56-439fcc2ace96","new_score":47,"page_slug":"deltaprime","prev_score":22,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 22 → 47. Problems weighed by who is responsible: incidents the subject suffered −12.8, concerns that are not fraud −3.2, problems around the subject, caused by others −1.6.","score_delta":25,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 9bd802ed-524f-4182-b435-c7c2ab48522dcopy