Audit log

Every state-changing event for ForceBridge: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-27 20:21:10Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,573,680

   sig

   5GGq22xpksG7…GBA79Cvycopyexplorer ↗

   hash

   Ecdc34zsfGL6…D6YJrt1Zcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (5956 B) ▸

   {"actor":"system:backfill","investigation_id":"54a8ddaf-9849-484f-8c3a-7d1657adcfa2","kind":"publish","page_slug":"forcebridge","published_at":"2026-05-27T20:21:10.222Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"ForceBridge","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.cryptoninjas.net/2021/10/14/nervos-force-bridge-now-live-to-allow-cross-chain-connection-to-ethereum-cardano-polkadot/","type":"other","url":""},{"credibility":3,"name":"https://forkast.news/headlines/nervos-launches-cross-chain-force-bridge/","type":"other","url":""},{"credibility":3,"name":"https://sunset.forcebridge.com/announcement","type":"other","url":""},{"credibility":3,"name":"https://medium.com/nervosnetwork/nervos-launches-force-bridge-to-connect-ethereum-dapps-users-with-ckb-24450df468f4","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://mpost.io/cyvers-alerts-detects-3m-exploit-on-nervos-network-bridge-magickbase-suspends-contracts-amid-investigation/","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-force-bridge-hack-june-2025","type":"other","url":""},{"credibility":3,"name":"https://crypto.news/nervos-network-suffers-major-exploit-as-3-9m-in-crypto-is-stolen-from-force-bridge/","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2025/06/02/nervos-networks-force-bridge-loses-3-million-in-defi-exploit/","type":"other","url":""},{"credibility":3,"name":"https://cryptonewsland.com/nervos-networks-force-bridge-breached-crypto-losses-reach-3-9-million/","type":"other","url":""},{"credibility":3,"name":"https://de.fi/blog/de-fi-rekt-report-june-2025-114-8-million-lost-across-11-exploits","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-force-bridge-hack-june-2025","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2025/06/02/nervos-networks-force-bridge-loses-3-million-in-defi-exploit/","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/crypto-hacks-nervos-force-bridge-bitopro-exchange/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.okx.com/en-us/news/article/magickbase-3-7-million-funds-affected-due-hack-45867251099680","type":"other","url":""},{"credibility":3,"name":"https://mpost.io/cyvers-alerts-detects-3m-exploit-on-nervos-network-bridge-magickbase-suspends-contracts-amid-investigation/","type":"other","url":""},{"credibility":3,"name":"https://sunset.forcebridge.com/announcement","type":"other","url":""},{"credibility":3,"name":"https://cryptorank.io/news/feed/89e3b-threat-actors-take-over-nervos-network","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://sunset.forcebridge.com/announcement","type":"other","url":""},{"credibility":3,"name":"https://sunset.forcebridge.com/","type":"other","url":""},{"credibility":3,"name":"https://forkast.news/headlines/nervos-launches-cross-chain-force-bridge/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-force-bridge-hack-june-2025","type":"other","url":""},{"credibility":3,"name":"https://cryptonewsland.com/nervos-networks-force-bridge-breached-crypto-losses-reach-3-9-million/","type":"other","url":""},{"credibility":3,"name":"https://blog.1inch.com/cross-chain-bridge-vulnerabilities/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.okx.com/en-us/news/article/magickbase-3-7-million-funds-affected-due-hack-45867251099680","type":"other","url":""}]}],"sources_used":[],"summary":"ForceBridge is a cross-chain bridge operated by Magickbase on the Nervos Network (CKB), enabling transfers between Nervos and Ethereum and BNB Chain. On June 2, 2025, the bridge was exploited via an access control vulnerability — likely a compromised private key — resulting in approximately $3.7–3.9 million in user funds being stolen and laundered through Tornado Cash. The exploit occurred just one day after Magickbase announced the bridge's sunset, raising questions about the timing and origin of the attack.","timeline":[{"date":"2021-10-14","event":"ForceBridge launches on Nervos Network mainnet, enabling cross-chain transfers between CKB, Ethereum, Cardano, and Polkadot.","source":""},{"date":"2025-05-31","event":"Magickbase announces the sunset of ForceBridge and Godwoken, citing low user activity and high maintenance costs. Six-month withdrawal window announced.","source":""},{"date":"2025-06-02","event":"ForceBridge exploited via access control vulnerability (likely compromised private key). Approximately $3.7–3.9 million in ETH, USDC, USDT, DAI, and WBTC stolen across Ethereum and BNB Chain.","source":""},{"date":"2025-06-02","event":"Cyvers Alerts first detects and reports suspicious activity involving ForceBridge on X.","source":""},{"date":"2025-06-02","event":"Magickbase pauses all ForceBridge bridge contracts and announces investigation. Stolen funds are laundered through Tornado Cash and FixedFloat.","source":""},{"date":"2025-06-02","event":"Magickbase publicly discloses $3.7 million in affected funds and announces cooperation with law enforcement and partner exchanges.","source":""},{"date":"2025-06-02","event":"Halborn Security publishes technical post-mortem attributing hack to access control failure, noting suspicious timing relative to sunset announcement.","source":""},{"date":"2026-01-16","event":"Extended deadline for user withdrawals from Force Bridge. Remaining funds to be held in Magickbase custody.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision a4fc6efb-2837-41b1-a8b5-3433b8f9d7f5copy
2. #2rescoreby systemsystem

   2026-10-10 18:40:43Z
   Score: 20 → 50 (+30)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 20 → 50. Problems weighed by who is responsible: the subject's own conduct −8, incidents the subject suffered −3.2, problems around the subject, caused by others −3.2, concerns that are not fraud −3.2; legitimacy credit long-running +8; no longer operating, so capped at 50.
   anchoranchored

   chain

   ●mainnet-betaslot 455,359,355

   sig

   4ueMmrMt53gf…y3zGGMu6copyexplorer ↗

   hash

   bDkFWudczk3C…2bBuYB2vcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (710 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:40:43.854Z","decision":"rescore","investigation_id":"54a8ddaf-9849-484f-8c3a-7d1657adcfa2","new_score":50,"page_slug":"forcebridge","prev_score":20,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 20 → 50. Problems weighed by who is responsible: the subject's own conduct −8, incidents the subject suffered −3.2, problems around the subject, caused by others −3.2, concerns that are not fraud −3.2; legitimacy credit long-running +8; no longer operating, so capped at 50.","score_delta":30,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision f300bf9e-2cbb-42c8-97ba-7c5061a082c5copy
3. #3reviewby reviewerreviewer

   2026-10-27 06:53:37Z
   Score: 50 → 50 (no score change)
   The core facts hold: the June 2025 access-control exploit, the loss of roughly $3.7-3.9M, laundering through Tornado Cash and FixedFloat, the asset breakdown, the sunset dates and the Magickbase response all match Halborn, Rekt, OKX/PANews and the official sunset page. Three weak spots remain. The $25 test drain and exact UTC timestamps are unsourced. The compromised-key cause is inference. The 'systemic operational security failure' conclusion is editorial. The exploit date also varies by a day across sources depending on timezone. No claims are contradicted.
   anchoranchored

   chain

   ●mainnet-betaslot 461,976,242

   sig

   fQ5LPW2oxtn3…MEyz62QRcopyexplorer ↗

   hash

   AUMWu8DL2nVz…ai7hQD5gcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1415 B) ▸

   {"actor":"reviewer","artifact_identity":"ff4f68d88008f308c7863058d39e7495","decided_at":"2026-10-27T06:53:37.405Z","decision":"review","disputed_pct":0.25,"findings_hash":"4bAJvvCT2PN58mqELEpbnpCyMxYKeumz5ymnwW8fz416","investigation_id":"54a8ddaf-9849-484f-8c3a-7d1657adcfa2","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":50,"omissions":{"material":0,"total":1},"page_content_hash":"899516884fb0f19c3454ebd678cd44b52c4f508e66950a410c712bbc74c3a16c","page_slug":"forcebridge","prev_score":50,"reason":"The core facts hold: the June 2025 access-control exploit, the loss of roughly $3.7-3.9M, laundering through Tornado Cash and FixedFloat, the asset breakdown, the sunset dates and the Magickbase response all match Halborn, Rekt, OKX/PANews and the official sunset page. Three weak spots remain. The $25 test drain and exact UTC timestamps are unsourced. The compromised-key cause is inference. The 'systemic operational security failure' conclusion is editorial. The exploit date also varies by a day across sources depending on timezone. No claims are contradicted.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":3,"subject_status":"shut_down","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 74c3856d-4dc6-4ffa-82bb-e7fb528bb366copy
4. #4review reviseby judgejudge

   2026-10-27 06:53:37Z
   Score: 50 → 50 (no score change)
   Of 12 claims checked, none were contradicted, but 3 could not be verified (claim_findings[2], [10], [11]), giving a 25% unverified share. The core incident, loss amounts, asset breakdown, laundering route, sunset dates and team response were confirmed by multiple sources and the official sunset page. The page also states two inferences more firmly than sources allow: the compromised-key cause (claim_findings[1]) and the 'systemic operational security failure' conclusion (claim_findings[8]). The one omission, post-January 2026 withdrawal status, is minor, and the page already covers the shutdown and exploit.
   anchoranchored

   chain

   ●mainnet-betaslot 461,976,247

   sig

   5s1nnBdRuqbm…aYUNoB9qcopyexplorer ↗

   hash

   pk7vACk1qWk5…jiwBBVcKcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1257 B) ▸

   {"actor":"judge","artifact_identity":"ff4f68d88008f308c7863058d39e7495","band_override":null,"decided_at":"2026-10-27T06:53:37.405Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.25,"investigation_id":"54a8ddaf-9849-484f-8c3a-7d1657adcfa2","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":50,"page_slug":"forcebridge","prev_score":50,"reason":"Of 12 claims checked, none were contradicted, but 3 could not be verified (claim_findings[2], [10], [11]), giving a 25% unverified share. The core incident, loss amounts, asset breakdown, laundering route, sunset dates and team response were confirmed by multiple sources and the official sunset page. The page also states two inferences more firmly than sources allow: the compromised-key cause (claim_findings[1]) and the 'systemic operational security failure' conclusion (claim_findings[8]). The one omission, post-January 2026 withdrawal status, is minor, and the page already covers the shutdown and exploit.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 8aa1d362-37df-4a66-804a-27adda09c062copy
5. #5reviewby reviewerreviewer

   2026-10-28 05:22:23Z
   Score: 50 → 50 (no score change)
   The page's core narrative — ForceBridge's October 2021 launch, Magickbase's May/June 2025 sunset announcement, the June 2, 2025 exploit (access-control failure, ~$3.7-3.9M stolen, Tornado Cash/FixedFloat laundering), Magickbase's public response, and the absence of regulatory action — is well supported by independently fetched, mostly reputable sources (The Block, Halborn, okx.com, crypto.news, mpost.io, sunset.forcebridge.com). Specific figures (asset amounts, UTC timestamps, loss ranges) were verified essentially exactly against tier-1/tier-2 sources. Two issues stand out: the timeline's claim that Cardano and Polkadot connectivity went live at the October 2021 launch is contradicted by the page's own cited launch-era sources, which describe those chains as 'coming soon' at the time; and there is an unresolved one-day discrepancy between the page's May 31, 2025 sunset-announcement date and the sunset site's own June 1, 2025 timeline entry, which the page's own 'one day after' framing of the exploit actually fits better if June 1 is correct. Neither issue is severe, but both should be corrected or caveated. No material omissions beyond minor currency-of-information points were found; the project's current shut-down/exploited status is accurately reflected in the page's own 'Protocol Sunset and Current Status' section.
   anchoranchored

   chain

   ●mainnet-betaslot 462,356,400

   sig

   ZX58V3fTrH95…BjuPQmyvcopyexplorer ↗

   hash

   9htt5rkKEcjR…69jVf6Xqcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (2129 B) ▸

   {"actor":"reviewer","artifact_identity":"0b7c8f9458dc176253f20234d4c5f4c5","decided_at":"2026-10-28T05:22:23.548Z","decision":"review","disputed_pct":0.0556,"findings_hash":"1E6tJNJXZM5bAQUAE1eftZuM55aFh7wbAsid6uLak73","investigation_id":"54a8ddaf-9849-484f-8c3a-7d1657adcfa2","mode":"findings_only","new_score":50,"omissions":{"material":1,"total":2},"page_content_hash":"899516884fb0f19c3454ebd678cd44b52c4f508e66950a410c712bbc74c3a16c","page_slug":"forcebridge","prev_score":50,"reason":"The page's core narrative — ForceBridge's October 2021 launch, Magickbase's May/June 2025 sunset announcement, the June 2, 2025 exploit (access-control failure, ~$3.7-3.9M stolen, Tornado Cash/FixedFloat laundering), Magickbase's public response, and the absence of regulatory action — is well supported by independently fetched, mostly reputable sources (The Block, Halborn, okx.com, crypto.news, mpost.io, sunset.forcebridge.com). Specific figures (asset amounts, UTC timestamps, loss ranges) were verified essentially exactly against tier-1/tier-2 sources. Two issues stand out: the timeline's claim that Cardano and Polkadot connectivity went live at the October 2021 launch is contradicted by the page's own cited launch-era sources, which describe those chains as 'coming soon' at the time; and there is an unresolved one-day discrepancy between the page's May 31, 2025 sunset-announcement date and the sunset site's own June 1, 2025 timeline entry, which the page's own 'one day after' framing of the exploit actually fits better if June 1 is correct. Neither issue is severe, but both should be corrected or caveated. No material omissions beyond minor currency-of-information points were found; the project's current shut-down/exploited status is accurately reflected in the page's own 'Protocol Sunset and Current Status' section.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":5,"subject_status":"shut_down","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 1d704d15-1416-410f-9240-a4d617ca1780copy