Audit log

Every state-changing event for EasyFi: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-22 04:05:30Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 421,342,896

   sig

   2PZFzA8pxLFj…mz9Kx5RAcopyexplorer ↗

   hash

   6wxLw1yWcuRn…Pe4ue6JFcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (7075 B) ▸

   {"actor":"system:backfill","investigation_id":"791df2de-5786-4056-a92a-9f5c584c9057","kind":"publish","page_slug":"easyfi","published_at":"2026-05-22T04:05:30.294Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"EasyFi","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/markets/2021/04/20/defi-protocol-easyfi-reports-hack-loss-of-over-80m-in-funds","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-easyfi-hack-april-2021","type":"other","url":""},{"credibility":3,"name":"https://cryptobriefing.com/easyfi-hacked-over-80-million-metamask-attack/","type":"other","url":""},{"credibility":3,"name":"https://thedefiant.io/news/hacks/compound-finance-fork-easyfi-loses-over-60m-in-admin-key-hack","type":"other","url":""},{"credibility":3,"name":"https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/easyfi.md","type":"other","url":""},{"credibility":3,"name":"https://chainbulletin.com/easyfi-hack-was-caused-by-compromised-admin-keys","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-easyfi-hack-april-2021","type":"other","url":""},{"credibility":3,"name":"https://chainbulletin.com/easyfi-hack-was-caused-by-compromised-admin-keys","type":"other","url":""},{"credibility":3,"name":"https://www.scmagazine.com/analysis/application-security/centralization-ironically-most-common-cause-of-decentralized-finance-hacks","type":"other","url":""},{"credibility":3,"name":"https://www.linkedin.com/pulse/easyfi-lending-protocol-smart-contract-final-audit-halborn-jimoh","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://medium.com/easify-network/interim-compensation-plan-8fa81e46ada4","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/reeling-from-post-hack-price-slump-easyfi-reveals-community-compensation-plan","type":"other","url":""},{"credibility":3,"name":"https://medium.com/coinmonks/the-fall-of-easyfi-network-c4c6773a1378","type":"other","url":""},{"credibility":3,"name":"https://bitcoinist.com/security-incident-easyfi-to-compensate-100-of-the-depositors-net-balances/","type":"other","url":""},{"credibility":3,"name":"https://medium.com/easify-network/easyfi-security-incident-66c02a277a91","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://medium.com/coinmonks/the-fall-of-easyfi-network-c4c6773a1378","type":"other","url":""},{"credibility":3,"name":"https://gbaglobal.org/blog/2021/04/29/after-the-hack-is-easyfi-trustworthy/","type":"other","url":""},{"credibility":3,"name":"https://www.cryptoscoop.io/reeling-from-post-hack-price-slump-easyfi-reveals-community-compensation-plan/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cointelegraph.com/news/reeling-from-post-hack-price-slump-easyfi-reveals-community-compensation-plan","type":"other","url":""},{"credibility":3,"name":"https://www.coinbase.com/price/easyfi","type":"other","url":""},{"credibility":3,"name":"https://coinmarketcap.com/currencies/easyfi/","type":"other","url":""},{"credibility":3,"name":"https://medium.com/easify-network/easyfi-roadmap-2022-5f94cbbc8395","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blockonomi.com/easyfi-guide/","type":"other","url":""},{"credibility":3,"name":"https://www.crunchbase.com/organization/easyfi","type":"other","url":""},{"credibility":3,"name":"https://tracxn.com/d/companies/easyfi/__8w98Z6QokAZD1UFWk8ppUarbZ_WS0Fw8ux650ruN-2Y","type":"other","url":""},{"credibility":3,"name":"https://www.newsbtc.com/news/company/easyfi-lending-protocol-goes-live-with-money-markets-on-polygon/","type":"other","url":""}]}],"sources_used":[],"summary":"EasyFi was a Layer 2 DeFi lending protocol operating on Polygon Network, forked from Compound Finance, that suffered one of the largest DeFi hacks of 2021 when an attacker compromised the CEO's MetaMask admin keys on April 19, 2021, stealing approximately $81 million in EASY tokens and stablecoins. The protocol attempted a hard fork and compensation plan, but a significant portion of token holders on decentralized exchanges alleged they remained uncompensated, and community members raised concerns about transparency, censorship of dissent, and the fundamental security failure of managing over $100 million in assets through a single admin key held in a browser extension. ZachXBT has flagged EasyFi as a high-risk entity.","timeline":[{"date":"2020-01-01","event":"EasyFi founded by Ankitt Gaur and Anshul Dhir as a Compound Finance fork on Polygon (Matic) Network.","source":""},{"date":"2021-04-01","event":"EasyFi launched on Binance Smart Chain and partnered with PancakeSwap for yield farming incentives, becoming a Binance Innovation Zone project.","source":""},{"date":"2021-04-19","event":"Attacker compromised CEO Ankitt Gaur's computer and extracted MetaMask admin seed phrase, stealing 2.98 million EASY tokens (~$75M) and $6M in stablecoins from liquidity pools. Total loss estimated at ~$81 million.","source":""},{"date":"2021-04-20","event":"EasyFi publicly disclosed the hack. CEO Ankitt Gaur posted a security incident report on Medium. Deposits and withdrawals suspended. Gaur offered a $1 million bounty for return of funds.","source":""},{"date":"2021-04-20","event":"EASY token price dropped approximately 50%, falling from ~$25 to ~$13.50 within 24 hours of disclosure.","source":""},{"date":"2021-04-27","event":"Binance halted EASY trading pairs and took a snapshot of user holdings, distributing new EZ tokens at a 1:1 ratio to eligible holders.","source":""},{"date":"2021-04-28","event":"EasyFi executed a hard fork, launching EZ token (v2) and rendering the attacker's stolen EASY tokens worthless on the new contract. Ticker changed from EASY to EZ.","source":""},{"date":"2021-05-01","event":"Stolen funds traced through Ren Bridge to Ethereum, converted to ~123 Bitcoin, laundered via Chipmixer, and deposited to Binance and P2P exchanges (Noones, Paxful).","source":""},{"date":"2021-05-08","event":"EasyFi revealed community compensation plan: 25% immediate stablecoin payout, 75% in EZ IOU tokens redeemable for EZ v2. Users on decentralized exchanges alleged they were categorized as ineligible for full 1:1 swap compensation.","source":""},{"date":"2021-05-01","event":"Community members published accounts alleging bans from EasyFi Telegram for asking critical questions and alleged discriminatory compensation treatment for DEX users.","source":""},{"date":"2022-01-01","event":"EasyFi published 2022 roadmap indicating continued development plans. Protocol activity and community engagement reportedly declined significantly following the hack.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 24ca3ac0-f550-44b6-91f9-7ce4fd8edad8copy
2. #2rescoreby systemsystem

   2026-10-10 18:48:57Z
   Score: 10 → 55 (+45)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 55. Problems weighed by who is responsible: concerns that are not fraud −9.6, incidents the subject suffered −3.2, problems around the subject, caused by others −1.6; legitimacy credit long-running +4.
   anchoranchored

   chain

   ●mainnet-betaslot 455,368,964

   sig

   2yDQ5nGKLVQ6…s6AxEquZcopyexplorer ↗

   hash

   7Kp8Szy5PdVE…8PTujR9hcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (637 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:48:57.523Z","decision":"rescore","investigation_id":"791df2de-5786-4056-a92a-9f5c584c9057","new_score":55,"page_slug":"easyfi","prev_score":10,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 55. Problems weighed by who is responsible: concerns that are not fraud −9.6, incidents the subject suffered −3.2, problems around the subject, caused by others −1.6; legitimacy credit long-running +4.","score_delta":45,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 74879a72-94a3-406c-ab73-b7ce895051adcopy
3. #3reviewby reviewerreviewer

   2026-11-02 09:34:09Z
   Score: 55 → 55 (no score change)
   The core hack facts (date, amounts, method, attacker addresses, compensation terms, price figures) are corroborated by CoinDesk, Halborn, Cointelegraph and the Monahan repository. Problems are: the unsourced ZachXBT claim, the 123 BTC and Ren Bridge details, an unsourced timeline entry that conflicts with the Polygon description (BSC launch), the Halborn audit claim, and a one-day error in the compensation date. No shutdown or sanction was found, but the project looks dormant.
   anchoranchored

   chain

   ●mainnet-betaslot 464,446,644

   sig

   5M1MB6CWnPAg…m4Xs1Rzdcopyexplorer ↗

   hash

   85gHgs16LiS3…b8aiw6Ltcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1325 B) ▸

   {"actor":"reviewer","artifact_identity":"8a6c42d94e703f04cf5cdb2bf1374807","decided_at":"2026-11-02T09:34:09.352Z","decision":"review","disputed_pct":0.3636,"findings_hash":"7AZHX6537NeSt41KdZG3eKj5pZtm71niePwdhbKtkQSc","investigation_id":"791df2de-5786-4056-a92a-9f5c584c9057","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":55,"omissions":{"material":0,"total":1},"page_content_hash":"8cc1c6083de8c1f2e4b818b18121cbc4cfbb7f211497ead30ae4271008c4c4a0","page_slug":"easyfi","prev_score":55,"reason":"The core hack facts (date, amounts, method, attacker addresses, compensation terms, price figures) are corroborated by CoinDesk, Halborn, Cointelegraph and the Monahan repository. Problems are: the unsourced ZachXBT claim, the 123 BTC and Ren Bridge details, an unsourced timeline entry that conflicts with the Polygon description (BSC launch), the Halborn audit claim, and a one-day error in the compensation date. No shutdown or sanction was found, but the project looks dormant.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":3,"subject_status":"unknown","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision b5c55e9f-82c0-4f6d-a178-d558a9c0a4d0copy
4. #4review reviseby judgejudge

   2026-11-02 09:34:09Z
   Score: 55 → 55 (no score change)
   Four of ten reviewed claims (40%) were disputed or could not be verified. The core hack facts (April 19, 2021 date, roughly $81M loss, attacker addresses, compensation terms) were confirmed by CoinDesk, Halborn and Cointelegraph. The problems are claim_findings[9], a ZachXBT high-risk flag in the summary with no source, claim_findings[5], a Binance Smart Chain launch entry that has no source and conflicts with the page's own Polygon description, claim_findings[2], the 123 BTC figure and Ren Bridge route that were not found in the cited source, and claim_findings[6], a compensation date that is one day off. The penalty is kept in the lower half of the band because the reviewer's confidence is moderate (0.55) and the main allegations are supported. The reviewer found no shutdown or sanction, and the one omission (the token is still dormant in 2026) is minor.
   anchoranchored

   chain

   ●mainnet-betaslot 464,446,649

   sig

   4spC2DnbU6nH…q4W7NUb2copyexplorer ↗

   hash

   2vNcgUH8ZDVM…EPKeUrkCcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1508 B) ▸

   {"actor":"judge","artifact_identity":"8a6c42d94e703f04cf5cdb2bf1374807","band_override":null,"decided_at":"2026-11-02T09:34:09.352Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.3636,"investigation_id":"791df2de-5786-4056-a92a-9f5c584c9057","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":55,"page_slug":"easyfi","prev_score":55,"reason":"Four of ten reviewed claims (40%) were disputed or could not be verified. The core hack facts (April 19, 2021 date, roughly $81M loss, attacker addresses, compensation terms) were confirmed by CoinDesk, Halborn and Cointelegraph. The problems are claim_findings[9], a ZachXBT high-risk flag in the summary with no source, claim_findings[5], a Binance Smart Chain launch entry that has no source and conflicts with the page's own Polygon description, claim_findings[2], the 123 BTC figure and Ren Bridge route that were not found in the cited source, and claim_findings[6], a compensation date that is one day off. The penalty is kept in the lower half of the band because the reviewer's confidence is moderate (0.55) and the main allegations are supported. The reviewer found no shutdown or sanction, and the one omission (the token is still dormant in 2026) is minor.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 4d0664ad-696e-46ba-ae30-ed8dda1cae11copy