Audit log

Every state-changing event for DEXX: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-20 03:37:15Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 420,905,964

   sig

   3tpHKUDYutUV…52RaTzaqcopyexplorer ↗

   hash

   93rbMMY91QXu…S8TsKxLPcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (5939 B) ▸

   {"actor":"system:backfill","investigation_id":"d2393658-2e61-48b5-aade-38c8857d81b4","kind":"publish","page_slug":"dexx","published_at":"2026-05-20T03:37:15.178Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"DEXX","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://skynet.certik.com/projects/dexx"},{"credibility":3,"name":"","type":"other","url":"https://www.chaincatcher.com/en/article/2152340"},{"credibility":3,"name":"","type":"other","url":"https://www.coinglass.com/learn/dexx-scandal-en"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://en.theblockbeats.news/news/55791"},{"credibility":3,"name":"","type":"other","url":"https://www.chaincatcher.com/en/article/2152340"},{"credibility":3,"name":"","type":"other","url":"https://www.web3isgoinggreat.com/?id=dexx-losses"},{"credibility":3,"name":"","type":"other","url":"https://www.ellipal.com/blogs/news/dexx-exposed-the-importance-of-true-decentralized-wallets"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://bravenewcoin.com/insights/dexx-hack-investigation-unveils-over-8600-solana-wallet-links-slowmist-report"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/solana-dexx-hack-november-2024-suspicious-wallets"},{"credibility":3,"name":"","type":"other","url":"https://blockchain.news/flashnews/dexx-hacker-transfers-4700-eth-to-tornado-cash"},{"credibility":3,"name":"","type":"other","url":"https://www.chaincatcher.com/en/article/2156116"},{"credibility":3,"name":"","type":"other","url":"https://onekey.so/blog/ecosystem/what-does-it-mean-when-dexx-funds-are-all-laundered-through-tornado-cash/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.cryptopolitan.com/8620-solana-wallets-linked-to-the-dexx-hack/"},{"credibility":3,"name":"","type":"other","url":"https://financefeeds.com/8600-solana-addresses-linked-to-dexx-hack-total-losses-rise-to-30m/"},{"credibility":3,"name":"","type":"other","url":"https://www.thecoinrepublic.com/2024/11/30/30m-dexx-hack-linked-to-8600-solana-wallets/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://decrypt.co/306495/lbank-reveals-dexx-compensation-process-and-enhancing-crypto-and-meme-innovation"},{"credibility":3,"name":"","type":"other","url":"https://decrypt.co/305132/lbank-lead-seven-party-coalition-in-15-million-donation-drive-for-dexx-compensation"},{"credibility":3,"name":"","type":"other","url":"https://www.panewslab.com/en/articles/b0qi6kty"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.chaincatcher.com/en/article/2152340"},{"credibility":3,"name":"","type":"other","url":"https://blog.bitrace.io/dexx-incident-inspiration-understanding-crypto-custody-risks/"},{"credibility":3,"name":"","type":"other","url":"https://www.coinglass.com/learn/dexx-scandal-en"},{"credibility":3,"name":"","type":"other","url":"https://skynet.certik.com/projects/dexx"}]}],"sources_used":[],"summary":"DEXX is a Solana-based on-chain memecoin trading terminal that suffered a catastrophic private key compromise on November 16, 2024, resulting in approximately $30 million in user losses across more than 8,600 wallets. Despite marketing itself as non-custodial, DEXX stored user private keys in plaintext on its own servers — a centralization risk that CertiK had flagged as unresolved prior to the breach. A partial compensation initiative led by LBank was announced in early 2025, but full recovery of stolen funds remains unlikely as the attacker laundered substantial ETH through Tornado Cash.","timeline":[{"date":"2024-11-16","event":"DEXX private key breach begins; user assets across 8,600+ Solana wallets start draining in early morning hours","source":""},{"date":"2024-11-16","event":"CertiK confirms breach on Solana blockchain, attributes cause to improper private key management by DEXX platform","source":""},{"date":"2024-11-16","event":"DEXX founder Roy publicly acknowledges incident, asks for time to address the issue","source":""},{"date":"2024-11-16","event":"GoPlus Security warns DEXX victims of secondary phishing scams soliciting private key uploads","source":""},{"date":"2024-11-17","event":"DEXX applies for judicial wallet marking and requests Solana Foundation assistance to freeze hacker addresses","source":""},{"date":"2024-11-28","event":"SlowMist publishes investigation linking 8,612 Solana wallet addresses to attacker; total losses revised to $30 million","source":""},{"date":"2024-12-02","event":"SlowMist reveals EVM chain victim and attacker addresses, expanding scope to 7,205 EVM wallets","source":""},{"date":"2024-12-09","event":"Attacker begins depositing stolen ETH into Tornado Cash; initial transfers of approximately 1,000 ETH reported","source":""},{"date":"2024-12-09","event":"DEXX hacker transfers 4,700 ETH to Tornado Cash in a single batch","source":""},{"date":"2024-12-10","event":"Additional 300 ETH batch transferred to Tornado Cash by DEXX attacker; SlowMist founder Cosine confirms","source":""},{"date":"2024-12-14","event":"DEXX launches formal compensation portal for affected users","source":""},{"date":"2025-02-05","event":"DEXX opens compensation NFT staking portal, allowing affected users to participate in repayment scheme","source":""},{"date":"2025-02-08","event":"LBank announces $15 million seven-party coalition donation initiative for DEXX user compensation","source":""},{"date":"2025-02-18","event":"LBank reports more than 3,000 addresses have received compensation payments; compensation process at approximately 30% completion","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 17a0f12d-f48c-4e93-8ebb-eb72993ca3accopy
2. #2rescoreby systemsystem

   2026-10-10 18:42:52Z
   Score: 10 → 43 (+33)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 43. Problems weighed by who is responsible: the subject's own conduct −8, incidents the subject suffered −6.4, concerns that are not fraud −6.4, problems around the subject, caused by others −0.8.
   anchoranchored

   chain

   ●mainnet-betaslot 455,362,744

   sig

   676BY31ho9au…8xgQNcpQcopyexplorer ↗

   hash

   3vxf8EmCqwF3…ZTBiC8Vucopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (630 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:42:52.267Z","decision":"rescore","investigation_id":"d2393658-2e61-48b5-aade-38c8857d81b4","new_score":43,"page_slug":"dexx","prev_score":10,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 43. Problems weighed by who is responsible: the subject's own conduct −8, incidents the subject suffered −6.4, concerns that are not fraud −6.4, problems around the subject, caused by others −0.8.","score_delta":33,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 3f2580c8-c28d-4fd7-9c3b-50747aa68c88copy
3. #3reviewby reviewerreviewer

   2026-11-08 02:34:25Z
   Score: 43 → 43 (no score change)
   A small sample of claims was checked. The SlowMist figures, the loss revision, the victim counts and the LBank coalition are supported by the sources fetched. The 8,848 and 7,205 figures were not found in the source fetched. The Dec 14 portal and 80% revenue sentence blends two dates (the pledge was Dec 6). The Thala Labs ranking claim is unsupported and internally inconsistent. Current status is unknown. Most other claims and several cited sources (two chaincatcher pages gone, ellipal not found) were not verified.
   anchoranchored

   chain

   ●mainnet-betaslot 466,748,999

   sig

   LMAhAN1Gvs9a…BPZCtaYqcopyexplorer ↗

   hash

   6zviV4R4wcRE…7bNTiLKpcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1362 B) ▸

   {"actor":"reviewer","artifact_identity":"f8a507ffb2b21d7268059babc19bde4d","decided_at":"2026-11-08T02:34:25.432Z","decision":"review","disputed_pct":0.1667,"findings_hash":"2yP6NiArVYhSqRZbWtmvxFokPt9Dzfs8yMcPQP1RZgjv","investigation_id":"d2393658-2e61-48b5-aade-38c8857d81b4","judge_def_hash":"750934ecb48272224909b7430fab271676d391380fbc821acbe7ee7e4cac2fa3","new_score":43,"omissions":{"material":0,"total":1},"page_content_hash":"c40cbb419aadd7fbc07afbdabfb210dcb56b7b02bfded477e5a36b86dff01fb7","page_slug":"dexx","prev_score":43,"reason":"A small sample of claims was checked. The SlowMist figures, the loss revision, the victim counts and the LBank coalition are supported by the sources fetched. The 8,848 and 7,205 figures were not found in the source fetched. The Dec 14 portal and 80% revenue sentence blends two dates (the pledge was Dec 6). The Thala Labs ranking claim is unsupported and internally inconsistent. Current status is unknown. Most other claims and several cited sources (two chaincatcher pages gone, ellipal not found) were not verified.","reviewer_def_hash":"3839668b232611e5b26db72079d64745f8e57e919b8a379e79b44ba4a52c845b","score_delta":0,"sequence_num":3,"subject_status":"unknown","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 19a211fe-c6bc-41ca-94bd-c6440608a92bcopy
4. #4review reviseby judgejudge

   2026-11-08 02:34:25Z
   Score: 43 → 43 (no score change)
   Of six claims checked, one (the Thala Labs ranking, claim_findings[5]) could not be supported and is internally inconsistent with the page's own $30M loss figure, which puts disputed plus unverifiable at 1 of 6 (about 17%). Two other claims were only partly supported: the 8,848 and 7,205 victim-address figures were not found in the fetched source (claim_findings[0]), and the 80% revenue pledge dates to Dec 6, not Dec 14 (claim_findings[4]). The core allegations (plaintext key storage, SlowMist figures, the $21M to $30M revision, the LBank coalition) were confirmed. The penalty is kept small because the reviewer's confidence is low (0.4) and most cited sources were not checked, but a high-priority gap on the platform's current status and payout progress after February 2025 keeps this at revise rather than approve.
   anchoranchored

   chain

   ●mainnet-betaslot 466,749,005

   sig

   4uPsh9Yhv4MX…uyzVciBhcopyexplorer ↗

   hash

   6TwKP7PqBjWn…sqET6n2mcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1462 B) ▸

   {"actor":"judge","artifact_identity":"f8a507ffb2b21d7268059babc19bde4d","band_override":null,"decided_at":"2026-11-08T02:34:25.432Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.1667,"investigation_id":"d2393658-2e61-48b5-aade-38c8857d81b4","judge_def_hash":"750934ecb48272224909b7430fab271676d391380fbc821acbe7ee7e4cac2fa3","new_score":43,"page_slug":"dexx","prev_score":43,"reason":"Of six claims checked, one (the Thala Labs ranking, claim_findings[5]) could not be supported and is internally inconsistent with the page's own $30M loss figure, which puts disputed plus unverifiable at 1 of 6 (about 17%). Two other claims were only partly supported: the 8,848 and 7,205 victim-address figures were not found in the fetched source (claim_findings[0]), and the 80% revenue pledge dates to Dec 6, not Dec 14 (claim_findings[4]). The core allegations (plaintext key storage, SlowMist figures, the $21M to $30M revision, the LBank coalition) were confirmed. The penalty is kept small because the reviewer's confidence is low (0.4) and most cited sources were not checked, but a high-priority gap on the platform's current status and payout progress after February 2025 keeps this at revise rather than approve.","reviewer_def_hash":"3839668b232611e5b26db72079d64745f8e57e919b8a379e79b44ba4a52c845b","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision e765816b-25ae-4ef1-a4df-c28c08872bfacopy