Audit log

Every state-changing event for DogWifTools: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-19 20:13:21Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 420,839,294

   sig

   tc59ZHTi1UVo…pWo3UZHAcopyexplorer ↗

   hash

   EuY2R8aWv2nB…JPiLyRNPcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6887 B) ▸

   {"actor":"system:backfill","investigation_id":"e05ca87b-8858-4518-b7e5-1ff5395b9bbf","kind":"publish","page_slug":"dogwiftools","published_at":"2026-05-19T20:13:21.463Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"DogWifTools","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://x.com/dogwiftools/status/1811888342591766584"},{"credibility":3,"name":"","type":"other","url":"https://docs.dogwiftools.com/dogwiftools/getting-started/bundler"},{"credibility":3,"name":"","type":"other","url":"https://www.bleepingcomputer.com/news/security/solana-pumpfun-tool-dogwiftool-compromised-to-drain-wallets/"},{"credibility":3,"name":"","type":"other","url":"https://www.rootdata.com/Projects/detail/DogWifTools?k=MTYxMzY%3D"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://docs.dogwiftools.com/dogwiftools/getting-started/bundler"},{"credibility":3,"name":"","type":"other","url":"https://www.bleepingcomputer.com/news/security/solana-pumpfun-tool-dogwiftool-compromised-to-drain-wallets/"},{"credibility":3,"name":"","type":"other","url":"https://www.cryptotimes.io/2025/01/30/solana-pump-fun-tool-dogwiftool-exploit-drains-10m-in-crypto/"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-dogwiftools-hack-january-2025"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.bleepingcomputer.com/news/security/solana-pumpfun-tool-dogwiftool-compromised-to-drain-wallets/"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-dogwiftools-hack-january-2025"},{"credibility":3,"name":"","type":"other","url":"https://www.cryptotimes.io/2025/01/30/solana-pump-fun-tool-dogwiftool-exploit-drains-10m-in-crypto/"},{"credibility":3,"name":"","type":"other","url":"https://www.mexc.com/news/410195"},{"credibility":3,"name":"","type":"other","url":"https://rekt.news/poetic-justice"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-dogwiftools-hack-january-2025"},{"credibility":3,"name":"","type":"other","url":"https://docs.dogwiftools.com/dogwiftools/getting-started/bundler"},{"credibility":3,"name":"","type":"other","url":"https://www.bleepingcomputer.com/news/security/solana-pumpfun-tool-dogwiftool-compromised-to-drain-wallets/"},{"credibility":3,"name":"","type":"other","url":"https://www.soliduslabs.com/reports/solana-rug-pulls-pump-dumps-crypto-compliance"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.bleepingcomputer.com/news/security/solana-pumpfun-tool-dogwiftool-compromised-to-drain-wallets/"},{"credibility":3,"name":"","type":"other","url":"https://www.rootdata.com/Projects/detail/DogWifTools?k=MTYxMzY%3D"},{"credibility":3,"name":"","type":"other","url":"https://www.scworld.com/brief/dogwiftools-breached-in-supply-chain-attack-on-cryptocurrency-wallets"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-dogwiftools-hack-january-2025"},{"credibility":3,"name":"","type":"other","url":"https://threats.wiz.io/all-incidents/dogwiftool-supply-chain-attack"},{"credibility":3,"name":"","type":"other","url":"https://www.dlnews.com/articles/defi/solana-execs-sued-over-memecoin-trades/"},{"credibility":3,"name":"","type":"other","url":"https://www.bleepingcomputer.com/news/security/solana-pumpfun-tool-dogwiftool-compromised-to-drain-wallets/"},{"credibility":3,"name":"","type":"other","url":"https://rekt.news/poetic-justice"}]}],"sources_used":[],"summary":"DogWifTools is a Solana-based memecoin tooling platform that markets features explicitly designed to simulate artificial trading volume, conceal supply concentration across hundreds of wallets, and inflate engagement metrics on pump.fun — capabilities that security researchers and blockchain analysts characterize as enabling wash trading and coordinated pump-and-dump schemes. In January 2025, the platform suffered a supply-chain attack in which threat actors trojaned versions 1.6.3 through 1.6.6 with a Remote Access Trojan, draining an estimated $10 million from users' wallets; the attacker group framed the theft as vigilante justice against scammers. No known regulatory action has been taken against DogWifTools operators, who remain anonymous.","timeline":[{"date":"2024-07-12","event":"DogWifTools v1.0 officially released on X, advertising volume bot, bundler, anti-detection bypass, and comment bot features for pump.fun token launches.","source":""},{"date":"2024-07-01","event":"Platform begins selling lifetime licenses at approximately 15 SOL, establishing a paid subscription base of memecoin operators.","source":""},{"date":"2025-01-01","event":"Threat actors reverse-engineer DogWifTools software and extract a GitHub authentication token, gaining covert access to the private repository.","source":""},{"date":"2025-01-27","event":"Threat actors trojanize DogWifTools versions 1.6.3 through 1.6.6, embedding a Remote Access Trojan (RAT) that downloads 'updater.exe' to harvest private keys, exchange credentials, and KYC identity documents from Windows users.","source":""},{"date":"2025-01-29","event":"DogWifTools users begin reporting mass wallet draining across hot and cold wallets; loss of Binance and Coinbase account access reported. Community estimates of losses reach $10 million.","source":""},{"date":"2025-01-29","event":"DogWifTools operators publicly attribute the compromise to a third-party actor who gained access via GitHub token; deny it is an internal rug pull.","source":""},{"date":"2025-01-30","event":"A group calling itself 'Jizzy Group' publishes a manifesto on a dark web onion site claiming responsibility for the attack, framing it as vigilante justice against scammers and calling Solana 'a fucking joke designed by criminals for criminals.'","source":""},{"date":"2025-01-30","event":"Major crypto security outlets including BleepingComputer, Halborn, Rekt News, CryptoTimes, and The Defiant publish coverage of the incident, widely characterizing DogWifTools as a 'fake liquidity generator.'","source":""},{"date":"2025-02-01","event":"Halborn Security publishes post-mortem analysis confirming supply-chain attack vector, RAT injection mechanism, and characterizing DogWifTools as infrastructure for wash trading and fake liquidity generation.","source":""},{"date":"2025-02-01","event":"Wiz Cloud Threat Landscape database catalogues the DogWifTool supply-chain attack as a notable 2025 security incident.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 4c85c2c7-468c-492d-b92f-a3deae9b958ecopy
2. #2rescoreby systemsystem

   2026-10-27 06:05:05Z
   Score: 4 → 0 (-4)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 4 → 0. The page establishes that the subject is itself a scheme, so the score is 0.
   anchoranchored

   chain

   ●mainnet-betaslot 461,964,934

   sig

   4XfxhSEn4ujt…tDtWPFwmcopyexplorer ↗

   hash

   4M55cTFoUkte…BCvwGd23copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (517 B) ▸

   {"actor":"system","decided_at":"2026-10-27T06:05:05.487Z","decision":"rescore","investigation_id":"e05ca87b-8858-4518-b7e5-1ff5395b9bbf","new_score":0,"page_slug":"dogwiftools","prev_score":4,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 4 → 0. The page establishes that the subject is itself a scheme, so the score is 0.","score_delta":-4,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 8246fea7-d6fc-4caf-b1e8-c468754e6845copy
3. #3reviewby reviewerreviewer

   2026-10-28 00:54:43Z
   Score: 0 → 0 (no score change)
   The core incident narrative is supported: trojanized Windows versions 1.6.3-1.6.6, a GitHub-token compromise, an estimated $10M loss, and a Jizzy Group manifesto. Problems are mostly overstatement. The $10M estimate is called 'documented', the Halborn quote is not verbatim, the Binance account claim contradicts Rekt on whose name was used, and the Jan 30 coverage entry lists Halborn, which published in February. The pricing, release date and 'continued operating' claims could not be verified, and the current operating status is unknown. Several cited sources (Wiz, DL News, SC World, CryptoTimes, MEXC, RootData) were not fetched.
   anchoranchored

   chain

   ●mainnet-betaslot 462,280,999

   sig

   ckvtkd22P1fA…1WKZCPSCcopyexplorer ↗

   hash

   2wSE5Y2DrxeC…XVnNd9zwcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1520 B) ▸

   {"actor":"reviewer","artifact_identity":"f238d216e8e8325a150322259899b95c","blocked_count":1,"decided_at":"2026-10-28T00:54:42.974Z","decision":"review","disputed_pct":0.2143,"findings_hash":"DQBQrtKsmWpzwfqg6b6qExzaSe1MsbUBCDzgBWWNt6su","investigation_id":"e05ca87b-8858-4518-b7e5-1ff5395b9bbf","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":0,"omissions":{"material":0,"total":2},"page_content_hash":"59874d7593a1697855cae582debc63c4f93534e78a322c50ea82e145bb34c634","page_slug":"dogwiftools","prev_score":0,"reason":"The core incident narrative is supported: trojanized Windows versions 1.6.3-1.6.6, a GitHub-token compromise, an estimated $10M loss, and a Jizzy Group manifesto. Problems are mostly overstatement. The $10M estimate is called 'documented', the Halborn quote is not verbatim, the Binance account claim contradicts Rekt on whose name was used, and the Jan 30 coverage entry lists Halborn, which published in February. The pricing, release date and 'continued operating' claims could not be verified, and the current operating status is unknown. Several cited sources (Wiz, DL News, SC World, CryptoTimes, MEXC, RootData) were not fetched.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":14,"sequence_num":3,"subject_status":"unknown","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 30b8a142-666b-4f30-97d2-769ec64f9a9dcopy
4. #4review reviseby judgejudge

   2026-10-28 00:54:43Z
   Score: 0 → 0 (no score change)
   The core incident narrative holds up: trojanized versions 1.6.3-1.6.6, the GitHub-token compromise, the estimated $10M loss and the Jizzy Group manifesto are all supported (claim_findings[0], [7], [8]). Of 14 countable findings (one blocked X source excluded), none were disputed and 3 were unverifiable (the 2025-01-27 date, the license price, and continued operation), about 21%. Five further claims were only partly supported: the $10M loss is called 'documented' (claim_findings[1]), the Binance account claim conflicts with the cited Rekt article (claim_findings[2]), the Halborn quote is not verbatim (claim_findings[3]), the Jan 30 coverage entry lists Halborn, which published in February (claim_findings[4]), and the Solidus wording is loosened (claim_findings[9]). The page's current operating status is also an open high-priority coverage gap. These are overstatements to correct rather than grounds to doubt the page.
   anchoranchored

   chain

   ●mainnet-betaslot 462,281,004

   sig

   3XADorDogdcR…XpCxCsQAcopyexplorer ↗

   hash

   53VjhHy6Asvg…7CCngmSAcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1609 B) ▸

   {"actor":"judge","artifact_identity":"f238d216e8e8325a150322259899b95c","band_override":null,"blocked_count":1,"decided_at":"2026-10-28T00:54:42.974Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.2143,"investigation_id":"e05ca87b-8858-4518-b7e5-1ff5395b9bbf","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":0,"page_slug":"dogwiftools","prev_score":0,"reason":"The core incident narrative holds up: trojanized versions 1.6.3-1.6.6, the GitHub-token compromise, the estimated $10M loss and the Jizzy Group manifesto are all supported (claim_findings[0], [7], [8]). Of 14 countable findings (one blocked X source excluded), none were disputed and 3 were unverifiable (the 2025-01-27 date, the license price, and continued operation), about 21%. Five further claims were only partly supported: the $10M loss is called 'documented' (claim_findings[1]), the Binance account claim conflicts with the cited Rekt article (claim_findings[2]), the Halborn quote is not verbatim (claim_findings[3]), the Jan 30 coverage entry lists Halborn, which published in February (claim_findings[4]), and the Solidus wording is loosened (claim_findings[9]). The page's current operating status is also an open high-priority coverage gap. These are overstatements to correct rather than grounds to doubt the page.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":14,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 7d0b47e4-20ee-4d8c-b04d-03b189d35467copy