Audit log

Every state-changing event for Early Solana Whale (Genesis Allocation) Theft: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-09-22 23:09:11Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 449,522,600

   sig

   2ncMjRAx2Qx7…PahUYDokcopyexplorer ↗

   hash

   7Ex2mzWA1w2N…cDYAuhyocopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (12546 B) ▸

   {"actor":"system:backfill","investigation_id":"e2a6bd01-0bad-443c-ad0b-5683f093c8ea","kind":"publish","page_slug":"early-solana-whale-genesis-allocation-theft","published_at":"2026-09-22T23:09:11.266Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Early Solana Whale (Genesis Allocation) Theft","sections":[{"content":"A wallet address identified by on-chain investigators as tied to Solana's original genesis-block token allocation — suggesting ownership by an early network backer, developer, or participant — had been dormant for an extended period before it suddenly unstaked a large SOL position and transferred the funds out. Reporting describes the amount moved as approximately 180,900 SOL, valued at roughly $14.2 million at the time of the incident. The activity was first detected by on-chain investigation firm Specter Investigation and subsequently publicized by independent on-chain investigator ZachXBT, who has a track record of exposing crypto fraud and theft. Multiple crypto news aggregators (KuCoin, Bitget, ChainCatcher, Odaily, CryptoRank, CryptoBriefing) republished the finding within hours of the original disclosure, indicating wide but largely derivative coverage rather than independent verification.","heading":"Nature of the Incident","severity":"high","sources":[{"credibility":2,"name":"Early Solana whale suspected of being hacked; 180,900 SOL stolen — KuCoin","type":"news_article","url":"https://www.kucoin.com/news/flash/early-solana-whale-suspected-of-being-hacked-180-900-sol-stolen"},{"credibility":2,"name":"ZachXBT: An early Solana whale appears to have been compromised, with 180,900 SOL transferred out — Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560605499730"},{"credibility":2,"name":"ZachXBT: Suspected early Solana whale... — ChainCatcher","type":"news_article","url":"https://www.chaincatcher.com/en/article/2275905"},{"credibility":2,"name":"ZachXBT: Suspected Attack on Early Solana Whale, Approximately 180,900 SOL Transferred — Odaily","type":"news_article","url":"https://www.odaily.news/en/newsflash/499526"}]},{"content":"Multiple outlets that carried the original disclosure explicitly state that the precise attack method has not been confirmed. Bitget News quoted the finding that 'the specific attack method, fund destination, and cause have not yet been confirmed.' A secondary write-up (AICoin) reported that investigators could not distinguish between private-key leakage, a phishing attack, or a contract/technical exploit, and speculated the likely cause was 'personal' key-security failure — such as outdated key backups or deteriorating hardware — rather than a protocol-level vulnerability, though this framing was not attributed to a named on-chain source and should be treated as informed speculation rather than established fact. CryptoBriefing similarly noted three possible scenarios (private-key compromise, phishing, or smart-contract exploitation) without confirming which applied. No named suspect or attacker identity has been publicly established in any source reviewed.","heading":"Attack Method — Unconfirmed","severity":"medium","sources":[{"credibility":2,"name":"ZachXBT: An early Solana whale appears to have been compromised, with 180,900 SOL transferred out — Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560605499730"},{"credibility":2,"name":"Why were 180,000 SOL stolen from the Solana Genesis whale? — AiCoin","type":"news_article","url":"https://www.aicoin.com/en/article/543732"},{"credibility":2,"name":"Solana wallet linked to genesis distribution loses $14.2M in theft — CryptoBriefing","type":"news_article","url":"https://cryptobriefing.com/solana-genesis-wallet-14m-theft/"}]},{"content":"Reporting consistently describes a sequence of unstaking the SOL position, consolidating it into new addresses, and bridging the funds from Solana to Ethereum. Tier-2 sources close to the original disclosure (Bitget, AICoin, CryptoBriefing) state that, as of their publication, it was not possible to confirm whether the funds subsequently entered a mixing service or a centralized exchange once on Ethereum — AICoin specifically noted that 'whether the funds entered a mixing service or centralized platform once they reached Ethereum currently lacks reliable public evidence.' One lower-tier secondary source (a Phemex 'Academy' explainer, which is not a primary or newsroom source and appears to synthesize the story after the fact) claims the funds were 'routed through Tornado Cash' — this claim is not corroborated by any of the closer-to-source reporting reviewed and directly conflicts with contemporaneous Tier 2 reporting stating the destination was unconfirmed. This specific claim is flagged as low confidence and should not be treated as established. No exchange, mixer, or wallet has been reliably and publicly confirmed as a final destination for the stolen funds in the sources reviewed.","heading":"Fund Flow and Unconfirmed Destination Claims","severity":"medium","sources":[{"credibility":2,"name":"Why were 180,000 SOL stolen from the Solana Genesis whale? — AiCoin","type":"news_article","url":"https://www.aicoin.com/en/article/543732"},{"credibility":2,"name":"Solana wallet linked to genesis distribution loses $14.2M in theft — CryptoBriefing","type":"news_article","url":"https://cryptobriefing.com/solana-genesis-wallet-14m-theft/"},{"credibility":3,"name":"Dormant Solana Whale Wallet Drained of $14 Million in 2026 — Phemex Academy","type":"other","url":"https://phemex.com/academy/solana-whale-wallet-loses-14-million"}]},{"content":"The KuCoin, Bitget, ChainCatcher, and Odaily reports of the incident were all published on 2026-07-10, with the ChainCatcher and Odaily items noting the wallet was 'suspected to have been attacked a few hours ago' at time of publication — indicating the theft was detected and disclosed on or immediately before July 10, 2026. One secondary source (Phemex Academy) instead states the wallet was emptied 'on or around July 13, 2026.' Given this discrepancy and that the Phemex piece is a non-newsroom explainer published after the fact, this dossier treats July 10, 2026 (the date supported by same-day, closer-to-source newsflash reporting) as the more reliable date for detection/disclosure of the theft, while noting the exact date the underlying unauthorized transactions occurred on-chain has not been independently verified by this investigation.","heading":"Date Uncertainty","severity":"low","sources":[{"credibility":2,"name":"ZachXBT: Suspected early Solana whale... — ChainCatcher","type":"news_article","url":"https://www.chaincatcher.com/en/article/2275905"},{"credibility":2,"name":"ZachXBT: Suspected Attack on Early Solana Whale, Approximately 180,900 SOL Transferred — Odaily","type":"news_article","url":"https://www.odaily.news/en/newsflash/499526"},{"credibility":3,"name":"Dormant Solana Whale Wallet Drained of $14 Million in 2026 — Phemex Academy","type":"other","url":"https://phemex.com/academy/solana-whale-wallet-loses-14-million"}]},{"content":"As of this investigation (conducted September 22, 2026, more than two months after the incident), no subsequent reporting has been found confirming the attacker's identity, recovery of any funds, exchange freezes tied to the stolen SOL/ETH, or a definitive determination of the attack vector. This absence of follow-up coverage is consistent with many crypto theft cases involving cross-chain bridging, where funds become difficult to trace once mixed with other flows, but it cannot be independently confirmed that no developments have occurred — only that no public developments were located via web search as of the investigation date.","heading":"Status as of September 2026 — No Confirmed Follow-Up","severity":"medium","sources":[{"credibility":2,"name":"Early Solana whale suspected of being hacked; 180,900 SOL stolen — KuCoin","type":"news_article","url":"https://www.kucoin.com/news/flash/early-solana-whale-suspected-of-being-hacked-180-900-sol-stolen"}]},{"content":"This incident is distinct from other, unrelated whale-targeting thefts reported around the same period, including separate cases involving repeat-phishing drains reported at approximately $25.6 million and the unrelated Drift Protocol exchange hack. It should not be conflated with those incidents when tracking fund flows or attacker infrastructure.","heading":"Distinction From Other Incidents","severity":"low","sources":[{"credibility":2,"name":"How Solana Exchange Drift Plans to Repay Users After $295 Million Crypto Hack — Decrypt","type":"news_article","url":"https://decrypt.co/366897/how-solana-exchange-drift-repay-users-295-million-crypto-hack"}]}],"sources_used":[{"credibility":2,"name":"Early Solana whale suspected of being hacked; 180,900 SOL stolen — KuCoin","type":"news_article","url":"https://www.kucoin.com/news/flash/early-solana-whale-suspected-of-being-hacked-180-900-sol-stolen"},{"credibility":2,"name":"ZachXBT: An early Solana whale appears to have been compromised, with 180,900 SOL transferred out — Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560605499730"},{"credibility":2,"name":"ZachXBT: Suspected early Solana whale... — ChainCatcher","type":"news_article","url":"https://www.chaincatcher.com/en/article/2275905"},{"credibility":2,"name":"ZachXBT: Suspected Attack on Early Solana Whale, Approximately 180,900 SOL Transferred — Odaily","type":"news_article","url":"https://www.odaily.news/en/newsflash/499526"},{"credibility":2,"name":"Why were 180,000 SOL stolen from the Solana Genesis whale? — AiCoin","type":"news_article","url":"https://www.aicoin.com/en/article/543732"},{"credibility":2,"name":"Solana wallet linked to genesis distribution loses $14.2M in theft — CryptoBriefing","type":"news_article","url":"https://cryptobriefing.com/solana-genesis-wallet-14m-theft/"},{"credibility":3,"name":"Dormant Solana Whale Wallet Drained of $14 Million in 2026 — Phemex Academy","type":"other","url":"https://phemex.com/academy/solana-whale-wallet-loses-14-million"},{"credibility":2,"name":"How Solana Exchange Drift Plans to Repay Users After $295 Million Crypto Hack — Decrypt","type":"news_article","url":"https://decrypt.co/366897/how-solana-exchange-drift-repay-users-295-million-crypto-hack"}],"summary":"On or around July 10, 2026, a Solana wallet reportedly linked to the network's original genesis-block token distribution — dormant for years — began unstaking large SOL positions and moved approximately 180,900 SOL (about $14.2 million at the time) off-chain via a bridge to Ethereum, in a pattern that on-chain investigator ZachXBT and firm Specter Investigation characterized as consistent with theft. As of this writing (September 22, 2026), the exact attack vector, the identity of the perpetrator, and the final destination of the funds on Ethereum remain unconfirmed in public reporting, and no follow-up disclosures, recoveries, or exchange freezes tied to this specific incident have been found.","timeline":[{"date":"2026-07","date_evidence":"an early whale address related to the initial allocation of the Solana genesis block was suspected to have been attacked a few hours ago","date_original":"2026-07-10","event":"On-chain investigation firm Specter Investigation detects unusual unstaking activity on a dormant Solana wallet linked to the network's genesis-block token distribution; ZachXBT publicizes the finding, reporting approximately 180,900 SOL (~$14.2 million) unstaked and bridged from Solana to Ethereum in a pattern consistent with theft.","source":"ChainCatcher / Odaily newsflash","source_url":"https://www.chaincatcher.com/en/article/2275905"},{"date":"2026-07","event":"Crypto news outlets (KuCoin, Bitget, CryptoRank, AiCoin, CryptoBriefing, BingX) republish and expand on the disclosure; reports converge on the theft pattern but explicitly state the attack method, attacker identity, and final destination of funds remain unconfirmed.","source":"Bitget News","source_url":"https://www.bitget.com/news/detail/12560605499730"},{"date":"2026-09","event":"As of this investigation (September 22, 2026), no publicly reported updates on attacker identity, fund recovery, or exchange/mixer confirmation have been found for this specific incident.","source":"AVOID.NET investigation (web search, September 2026)","source_url":"https://www.kucoin.com/news/flash/early-solana-whale-suspected-of-being-hacked-180-900-sol-stolen"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision a5dc446c-6290-497d-8c6c-2ba006ff612dcopy