Audit log

Every state-changing event for Hyperbridge: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-26 19:24:50Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,347,001

   sig

   5WKQm5amKD5h…LrMqxKCocopyexplorer ↗

   hash

   UPQCTRd3xoYk…8AxAdsgbcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (7774 B) ▸

   {"actor":"system:backfill","investigation_id":"e98dcb71-6fb2-41c3-9678-2430b35a4af0","kind":"publish","page_slug":"hyperbridge","published_at":"2026-05-26T19:24:50.010Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Hyperbridge","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blog.hyperbridge.network/april-13-post-mortem/","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/tech/2026/04/13/attacker-mints-usd1-billion-polkadot-tokens-on-ethereum-ends-up-stealing-just-usd250-000","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/hacker-steals-237k-1b-bridged-dot-hyperbridge","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2026/04/16/hyperbridge-raises-exploit-loss-estimate-to-2-5m-from-237k/","type":"other","url":""},{"credibility":3,"name":"https://www.theblock.co/post/397773/polkadot-hyperbridge-exploit-losses-2-5-million-ten-times-initial-estimate","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/hyperbridge-exploit-losses-revised-25m/","type":"other","url":""},{"credibility":3,"name":"https://ambcrypto.com/hyperbridge-revises-exploit-losses-to-2-5m-traces-funds-to-binance/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://protos.com/hyperbridge-exploited-less-than-two-weeks-after-april-fools-day-hack-prank/","type":"other","url":""},{"credibility":3,"name":"https://www.web3isgoinggreat.com/?id=hyperbridge-exploit","type":"other","url":""},{"credibility":3,"name":"https://cryptoslate.com/polkadot-hyperbridge-april-fools-joke-comes-true-as-over-1-billion-fake-dot-tokens-were-minted-on-ethereum/","type":"other","url":""},{"credibility":3,"name":"https://ambcrypto.com/hyperbridge-exploit-lets-attacker-mint-1b-bridged-dot-raising-questions-after-safest-bridge-claims/","type":"other","url":""},{"credibility":3,"name":"https://blog.hyperbridge.network/explained-hack-april-fool/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://protos.com/hyperbridge-exploited-less-than-two-weeks-after-april-fools-day-hack-prank/","type":"other","url":""},{"credibility":3,"name":"https://crypto.news/hyperbridge-launches-50k-bug-bounty-after-bridge-exploit/","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2026/05/15/hyperbridge-offers-50000-for-critical-vulnerabilities/","type":"other","url":""},{"credibility":3,"name":"https://www.autheo.com/blog/bridge-security-lessons-hyperbridge-exploit-2026","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blog.hyperbridge.network/recovery-and-next-steps/","type":"other","url":""},{"credibility":3,"name":"https://phemex.com/news/article/hyperbridge-revises-hack-losses-to-25-million-plans-compensation-73722","type":"other","url":""},{"credibility":3,"name":"https://forum.polkadot.network/t/pre-proposal-discussion-dot-recovery-loan-to-hyperbridge-token-gateway-exploit-victims/17552","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/hyperbridge-exploit-losses-revised-25m/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://techpoint.africa/feature/how-hyperbridge-works-seun-lanlege/","type":"other","url":""},{"credibility":3,"name":"https://techcabal.com/2025/04/17/polytope-labs-raises-over-5-million-to-scale-hyperbridge-backed-by-the-polkadot-ecosystem-fund/","type":"other","url":""},{"credibility":3,"name":"https://polkadot.com/newsroom/press-releases/hyperbridge-launches-on-Polkadot/","type":"other","url":""},{"credibility":3,"name":"https://en.wikipedia.org/wiki/Hyperbridge","type":"other","url":""},{"credibility":3,"name":"https://bitcoinke.io/2025/11/a-look-at-hyperbridge/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://protos.com/hyperbridge-exploited-less-than-two-weeks-after-april-fools-day-hack-prank/","type":"other","url":""},{"credibility":3,"name":"https://www.tronweekly.com/hyperbridge-suffers-237000-breach-as-token-gate/","type":"other","url":""},{"credibility":3,"name":"https://ambcrypto.com/hyperbridge-revises-exploit-losses-to-2-5m-traces-funds-to-binance/","type":"other","url":""}]}],"sources_used":[],"summary":"Hyperbridge is a cross-chain interoperability protocol built by Polytope Labs (founded by Nigerian engineers Seun Lanlege and David Salami) that uses cryptographic proofs to facilitate asset and message transfers across blockchains. On April 13, 2026, an attacker exploited a Merkle Mountain Range (MMR) proof verification vulnerability in the Token Gateway contract, minting 1 billion fraudulent bridged DOT tokens and extracting losses initially reported at $237,000 but later revised to approximately $2.5 million across Ethereum, Base, BNB Chain, and Arbitrum. The exploit occurred less than two weeks after the project publicly mocked the possibility of being hacked in an April Fools joke, and followed alleged dismissals of security researchers who had flagged vulnerabilities beforehand.","timeline":[{"date":"2023-11-01","event":"Polytope Labs publicly launches Hyperbridge cross-chain bridge.","source":""},{"date":"2024-01-01","event":"Hyperbridge launches on Polkadot mainnet.","source":""},{"date":"2025-04-17","event":"Polytope Labs announces over $5 million in funding backed by the Polkadot Ecosystem Fund, Web3 Foundation, and Scytale Digital.","source":""},{"date":"2025-09-30","event":"Hyperbridge expands to Polygon mainnet; team markets protocol as 'the world's safest bridge' in official materials.","source":""},{"date":"2026-02-01","event":"Alleged: a bug bounty researcher reports critical vulnerabilities and is reportedly told 'exploit them if you found them' by the team.","source":""},{"date":"2026-04-01","event":"Hyperbridge posts April Fools' joke on X claiming the Lazarus Group drained $37 million; linked blog post contains Rickroll GIF and article titled 'Why Hyperbridge Can't Be Hacked.'","source":""},{"date":"2026-04-02","event":"A known exploiter address begins probing Hyperbridge; a developer dismisses attempts with 'hope you have a quantum computer bro.'","source":""},{"date":"2026-04-13","event":"Exploit occurs: attacker forges an MMR proof to seize admin control of the bridged DOT contract on Ethereum and mints 1 billion fake DOT tokens, extracting approximately 108.2 ETH (~$237,000) and an estimated 245 ETH from the TokenGateway contract, with funds deposited into Tornado Cash.","source":""},{"date":"2026-04-13","event":"Hyperbridge pauses Token Gateway operations; patch deployed within 72 hours; April Fools posts deleted.","source":""},{"date":"2026-04-16","event":"Hyperbridge revises total exploit losses to approximately $2.5 million — ten times the initial estimate — after reconciling activity across Ethereum, Base, BNB Chain, and Arbitrum.","source":""},{"date":"2026-04-16","event":"Stolen funds traced in part to Binance; Hyperbridge states it is cooperating with Binance compliance and law enforcement.","source":""},{"date":"2026-04-25","event":"Polkadot Forum pre-proposal discussion published proposing a DOT recovery loan from the Polkadot Treasury for liquidity providers affected by the exploit.","source":""},{"date":"2026-05-15","event":"Hyperbridge launches $50,000 bug bounty on HackenProof for critical vulnerabilities, following post-exploit SRLabs audit that found 14 vulnerabilities (1 critical, 3 high, 5 medium, 4 low, 1 informational), all reportedly remediated.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision e85e3f54-d527-43c2-8ad4-6165345c2532copy
2. #2rescoreby systemsystem

   2026-10-10 18:48:01Z
   Score: 32 → 55 (+23)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 32 → 55. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −6.4, problems around the subject, caused by others −1.6; legitimacy credit long-running +4.
   anchoranchored

   chain

   ●mainnet-betaslot 455,368,030

   sig

   4AJjs2zUb5DC…m7stjNM9copyexplorer ↗

   hash

   DntFpXD3ZSYJ…jff3rU4Rcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (642 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:48:01.327Z","decision":"rescore","investigation_id":"e98dcb71-6fb2-41c3-9678-2430b35a4af0","new_score":55,"page_slug":"hyperbridge","prev_score":32,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 32 → 55. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −6.4, problems around the subject, caused by others −1.6; legitimacy credit long-running +4.","score_delta":23,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 6cdbbbd7-fe91-4628-aef0-826542316efacopy
3. #3reviewby reviewerreviewer

   2026-10-27 19:24:39Z
   Score: 55 → 55 (no score change)
   The core exploit narrative (April 13, 2026 MMR flaw, 108.2 ETH / $237K initial, $2.5M revised, April Fools prank, SRLabs 14-finding audit, Parity disclosure) matches the official post-mortem, CoinDesk, Protos and Wikipedia, and alleged items are properly hedged. Weak points are the unsourced timeline entry placing the launch in 2023-11, the unconfirmed attribution of the 245 ETH detail to the post-mortem, and the unverified June 2026 relaunch, which I could not check and which sits alongside a July 2026 Bifrost notice saying Hyperbridge is being retired. Several cited sources were blocked (403).
   anchoranchored

   chain

   ●mainnet-betaslot 462,188,059

   sig

   2wxWDc8MfehS…SYynCqizcopyexplorer ↗

   hash

   Ggu5ScS1rscn…EGNLYqWVcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1488 B) ▸

   {"actor":"reviewer","artifact_identity":"d1af293c58830ec48529d9ac8d77d9e6","blocked_count":1,"decided_at":"2026-10-27T19:24:39.258Z","decision":"review","disputed_pct":0.1667,"findings_hash":"5b6i2sbKW4cabm4fkmyD8gJoVa6qS4549RCxKNCExHQP","investigation_id":"e98dcb71-6fb2-41c3-9678-2430b35a4af0","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":55,"omissions":{"material":1,"total":1},"page_content_hash":"31e73702864ea88cfd47d12aeed5c9968588a3fdb7cec7aec4cd2b25e4482dd0","page_slug":"hyperbridge","prev_score":55,"reason":"The core exploit narrative (April 13, 2026 MMR flaw, 108.2 ETH / $237K initial, $2.5M revised, April Fools prank, SRLabs 14-finding audit, Parity disclosure) matches the official post-mortem, CoinDesk, Protos and Wikipedia, and alleged items are properly hedged. Weak points are the unsourced timeline entry placing the launch in 2023-11, the unconfirmed attribution of the 245 ETH detail to the post-mortem, and the unverified June 2026 relaunch, which I could not check and which sits alongside a July 2026 Bifrost notice saying Hyperbridge is being retired. Several cited sources were blocked (403).","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":12,"sequence_num":3,"subject_status":"unknown","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 67a7f968-40ce-439b-a7f2-140b2be4cb75copy
4. #4review reviseby judgejudge

   2026-10-27 19:24:39Z
   Score: 55 → 55 (no score change)
   Of 14 claim findings, 13 count toward the percentage after leaving out one blocked source (the June 2026 relaunch, claim_findings[12]). None were disputed. Two were unverifiable: the 245 ETH attribution to the post-mortem (claim_findings[4]) and the unsourced September 2025 Polygon expansion (claim_findings[11]), giving about 15%. The core exploit narrative is confirmed by the post-mortem, CoinDesk and Protos, and alleged items are hedged. The page is revised and penalised toward the upper part of the minor band because the reviewer found a material omission, a July 2026 Bifrost notice saying Hyperbridge is being retired, and the page presents the June 2026 relaunch without caveat. Two timeline items are also weak: the unsourced November 2023 launch date (claim_findings[10]) and the unconfirmed April 16 production deployment (claim_findings[9]). A high-priority gap on current protocol status remains open.
   anchoranchored

   chain

   ●mainnet-betaslot 462,188,064

   sig

   4SAFeYWaebxR…7fpvUTuscopyexplorer ↗

   hash

   CJuaipoHgMMm…U82YSU5Mcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (2061 B) ▸

   {"actor":"judge","artifact_identity":"d1af293c58830ec48529d9ac8d77d9e6","band_override":null,"blocked_count":1,"decided_at":"2026-10-27T19:24:39.258Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.1667,"investigation_id":"e98dcb71-6fb2-41c3-9678-2430b35a4af0","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":55,"page_slug":"hyperbridge","prev_score":55,"reason":"Of 14 claim findings, 13 count toward the percentage after leaving out one blocked source (the June 2026 relaunch, claim_findings[12]). None were disputed. Two were unverifiable: the 245 ETH attribution to the post-mortem (claim_findings[4]) and the unsourced September 2025 Polygon expansion (claim_findings[11]), giving about 15%. The core exploit narrative is confirmed by the post-mortem, CoinDesk and Protos, and alleged items are hedged. The page is revised and penalised toward the upper part of the minor band because the reviewer found a material omission, a July 2026 Bifrost notice saying Hyperbridge is being retired, and the page presents the June 2026 relaunch without caveat. Two timeline items are also weak: the unsourced November 2023 launch date (claim_findings[10]) and the unconfirmed April 16 production deployment (claim_findings[9]). A high-priority gap on current protocol status remains open.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":12,"sequence_num":4,"severity_override":{"applied":false,"band":null,"from_band":"minor","reason":"The Bifrost retirement notice is a material omission, but it comes from a single partner rather than an official Polytope Labs or Hyperbridge notice, and the reviewer could not establish the protocol's current status (subject_status.contradicts_page is false). The minor band already applies and is set at the harsher end for this omission, so no further escalation is warranted."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision caafbe57-e09a-415d-905f-212ee3705ef9copy