Audit log

Every state-changing event for Ionic Protocol: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-28 01:44:43Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,622,670

   sig

   5kB1QNJXz6gk…wJ67qdWfcopyexplorer ↗

   hash

   rJBc5anxykJ8…gQSohGSkcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6627 B) ▸

   {"actor":"system:backfill","investigation_id":"43255326-3258-4cc6-b6b3-c293918c5c60","kind":"publish","page_slug":"ionic-protocol","published_at":"2026-05-28T01:44:43.580Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Ionic Protocol","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://medium.com/@ionicmoney/ionic-protocol-introduction-e6e0b748f538","type":"other","url":""},{"credibility":3,"name":"https://doc.ionic.money/ionic-documentation/ionic-protocol/introduction","type":"other","url":""},{"credibility":3,"name":"https://www.ionic.money/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://medium.com/midas-capital/midas-exploit-post-mortem-1ae266222994","type":"other","url":""},{"credibility":3,"name":"https://immunebytes.com/blog/midas-capital-hack-june-17-2023-detailed-analysis/","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/midas-capital-releases-660000-exploit-post-mortem-defi-attacks-carry-into-2023/","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/midas-capital-pool-exploited/","type":"other","url":""},{"credibility":3,"name":"https://x.com/zachxbt/status/1886792512917864953","type":"other","url":""},{"credibility":3,"name":"https://www.bitget.com/news/detail/12560604547626","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/ionic-money-rekt","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-ionic-money-hack-february-2025","type":"other","url":""},{"credibility":3,"name":"https://quadrigainitiative.com/casestudy/ionicmoneyfakelbtccollateralsocialengineering.php","type":"other","url":""},{"credibility":3,"name":"https://www.chaincatcher.com/en/article/2165720","type":"other","url":""},{"credibility":3,"name":"https://www.panewslab.com/en/articles/6d4lap4z","type":"other","url":""},{"credibility":3,"name":"https://postmortem.s3.us-east-1.amazonaws.com/postmortem.pdf","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://x.com/zachxbt/status/1886792512917864953","type":"other","url":""},{"credibility":3,"name":"https://www.bitget.com/news/detail/12560604547626","type":"other","url":""},{"credibility":3,"name":"https://followin.io/en/feed/16108999","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coingecko.com/en/coins/ionic-protocol","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/ionic-protocol","type":"other","url":""},{"credibility":3,"name":"https://www.gate.com/price/ionic-protocol-ion","type":"other","url":""},{"credibility":3,"name":"https://www.coincarp.com/currencies/ionic-protocol/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-ionic-money-hack-february-2025","type":"other","url":""},{"credibility":3,"name":"https://immunebytes.com/blog/midas-capital-hack-june-17-2023-detailed-analysis/","type":"other","url":""},{"credibility":3,"name":"https://x.com/zachxbt/status/1886792512917864953","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/ionic-money-rekt","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-ionic-money-hack-february-2025","type":"other","url":""},{"credibility":3,"name":"https://quadrigainitiative.com/casestudy/ionicmoneyfakelbtccollateralsocialengineering.php","type":"other","url":""}]}],"sources_used":[],"summary":"Ionic Protocol (also known as Ionic Money) is a decentralized non-custodial lending and borrowing protocol deployed on the Mode Network (OP Superchain). It is a rebrand of Midas Capital, which suffered two separate exploits in 2023 totaling approximately $1.26 million. In February 2025, Ionic itself was exploited via a social engineering attack involving a counterfeit LBTC token, resulting in losses estimated between $8.6 million and $12.3 million; funds were partially laundered through Tornado Cash and have not been recovered.","timeline":[{"date":"2021-11-01","event":"Midas Capital founded with a vision of multichain isolated-pool lending.","source":""},{"date":"2023-01-15","event":"Midas Capital first exploit: approximately $660,000 drained via read-only reentrancy vulnerability in Curve LP collateral on Polygon.","source":"","source_url":"https://medium.com/midas-capital/midas-exploit-post-mortem-1ae266222994"},{"date":"2023-06-17","event":"Midas Capital second exploit: approximately $600,000 drained via rounding error in Compound V2-derived code on BNB Chain.","source":"","source_url":"https://immunebytes.com/blog/midas-capital-hack-june-17-2023-detailed-analysis/"},{"date":"2023-01-01","event":"Midas Capital sunsetted; team begins rebrand to Ionic Protocol on Mode Network.","source":""},{"date":"2024-12-12","event":"Alleged attacker begins interacting with Ionic Protocol, impersonating Lombard Finance team in BD discussions.","source":"","source_url":"https://www.halborn.com/blog/post/explained-the-ionic-money-hack-february-2025"},{"date":"2025-01-09","event":"Attacker deploys counterfeit LBTC smart contract (0x964dd444e3192f636322229080a576077b06fba3).","source":"","source_url":"https://quadrigainitiative.com/casestudy/ionicmoneyfakelbtccollateralsocialengineering.php"},{"date":"2025-02-04","event":"Ionic Money exploit begins: attacker mints 250 fake LBTC, deposits as collateral, and borrows approximately $8.6–$12.3 million in real assets.","source":"","source_url":"https://rekt.news/ionic-money-rekt"},{"date":"2025-02-04","event":"Attacker bridges ~1,204 ETH ($3.2 million) from Mode Network to Ethereum and launders funds through Tornado Cash.","source":"","source_url":"https://www.halborn.com/blog/post/explained-the-ionic-money-hack-february-2025"},{"date":"2025-02-08","event":"Ionic team publishes official post-mortem; states the incident was not a code-based breach and pledges to work with law enforcement.","source":"","source_url":"https://postmortem.s3.us-east-1.amazonaws.com/postmortem.pdf"},{"date":"2025-02-04","event":"ZachXBT publicly flags the exploit and states 'Ionic is just Midas wearing a carnival mask,' referencing two prior 2023 hacks.","source":"","source_url":"https://x.com/zachxbt/status/1886792512917864953"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 9770ca75-8159-45e5-9474-83fa9d1167a0copy
2. #2rescoreby systemsystem

   2026-10-10 18:48:41Z
   Score: 18 → 53 (+35)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 18 → 53. Problems weighed by who is responsible: incidents the subject suffered −9.6, concerns that are not fraud −6.4, problems around the subject, caused by others −1.6; legitimacy credit long-running +6.
   anchoranchored

   chain

   ●mainnet-betaslot 455,368,600

   sig

   4Wv7Kzi6qp91…ue2Dckypcopyexplorer ↗

   hash

   DXYbXX7xKGCD…xHf8fnmmcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (645 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:48:40.929Z","decision":"rescore","investigation_id":"43255326-3258-4cc6-b6b3-c293918c5c60","new_score":53,"page_slug":"ionic-protocol","prev_score":18,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 18 → 53. Problems weighed by who is responsible: incidents the subject suffered −9.6, concerns that are not fraud −6.4, problems around the subject, caused by others −1.6; legitimacy credit long-running +6.","score_delta":35,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 058e4d38-34a4-493f-a53a-f3ebb9f092b0copy
3. #3reviewby reviewerreviewer

   2026-10-27 19:26:47Z
   Score: 53 → 53 (no score change)
   The core narrative holds: the fake-LBTC social-engineering exploit, the $6.9M and $8.6M loss figures, the 250 tokens, the 0.01 ETH starting balance and the Tornado Cash laundering match Halborn and Rekt. Two weaker points: the 1,204 ETH / $3.2M figure is attributed to Halborn, which says about $3.5M, and the final section's status statement is stale given DefiLlama's deprecated label. Only a small sample of claims was verified, and several sources were blocked or not fetched.
   anchoranchored

   chain

   ●mainnet-betaslot 462,188,601

   sig

   3bpVN67B3nfM…uxgWMjEYcopyexplorer ↗

   hash

   8mjeu1dRhwiF…AEtRrVi5copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1365 B) ▸

   {"actor":"reviewer","artifact_identity":"b669700f5a1ec0fa3089305f7b1ea373","blocked_count":1,"decided_at":"2026-10-27T19:26:47.434Z","decision":"review","disputed_pct":0,"findings_hash":"GK6VyFo5ejT4YV5WnuSbrd7MkP69cA2g3MYpL14AG9wz","investigation_id":"43255326-3258-4cc6-b6b3-c293918c5c60","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":53,"omissions":{"material":1,"total":1},"page_content_hash":"aa1161c5964d5ec02b14f083bc980e536c430bd0fa44fc88491794f18e30fbde","page_slug":"ionic-protocol","prev_score":53,"reason":"The core narrative holds: the fake-LBTC social-engineering exploit, the $6.9M and $8.6M loss figures, the 250 tokens, the 0.01 ETH starting balance and the Tornado Cash laundering match Halborn and Rekt. Two weaker points: the 1,204 ETH / $3.2M figure is attributed to Halborn, which says about $3.5M, and the final section's status statement is stale given DefiLlama's deprecated label. Only a small sample of claims was verified, and several sources were blocked or not fetched.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":5,"sequence_num":3,"subject_status":"shut_down","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 9845626b-0b2e-4314-b029-a5641842bd5dcopy
4. #4review reviseby judgejudge

   2026-10-27 19:26:47Z
   Score: 53 → 53 (no score change)
   The core account holds up: the fake-LBTC social-engineering exploit, the $6.9M and $8.6M loss figures and the Tornado Cash laundering match Halborn and Rekt News (claim_findings[0], [1]). Two points need correction. The 1,204 ETH / $3.2M bridged figure is attributed to Halborn, which says about $3.5M (claim_findings[2]). The closing section's statement that maintenance status is unclear is out of date, since DefiLlama lists the protocol as deprecated (claim_findings[4], omission_findings[0]). Because the deprecated-status source is secondary and could not be fetched directly, the adjustment is small. One market-data claim could not be checked because the source blocked the reviewer, which is a coverage limit and not a defect of the page.
   anchoranchored

   chain

   ●mainnet-betaslot 462,188,751

   sig

   23ubFFVSS2CK…CsScDqxZcopyexplorer ↗

   hash

   5c6shS9XVEHW…Xkygb9U5copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (2040 B) ▸

   {"actor":"judge","artifact_identity":"b669700f5a1ec0fa3089305f7b1ea373","band_override":null,"blocked_count":1,"decided_at":"2026-10-27T19:26:47.434Z","decision":"review_revise","delist_requested":false,"disputed_pct":0,"investigation_id":"43255326-3258-4cc6-b6b3-c293918c5c60","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":53,"page_slug":"ionic-protocol","prev_score":53,"reason":"The core account holds up: the fake-LBTC social-engineering exploit, the $6.9M and $8.6M loss figures and the Tornado Cash laundering match Halborn and Rekt News (claim_findings[0], [1]). Two points need correction. The 1,204 ETH / $3.2M bridged figure is attributed to Halborn, which says about $3.5M (claim_findings[2]). The closing section's statement that maintenance status is unclear is out of date, since DefiLlama lists the protocol as deprecated (claim_findings[4], omission_findings[0]). Because the deprecated-status source is secondary and could not be fetched directly, the adjustment is small. One market-data claim could not be checked because the source blocked the reviewer, which is a coverage limit and not a defect of the page.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":5,"sequence_num":4,"severity_override":{"applied":true,"band":"minor","from_band":"approve","reason":"By claim count no finding is disputed (0 of 5 counted findings; one source_blocked market-data finding excluded), which implies approve. omission_findings[0] is rated material: DefiLlama lists the protocol as deprecated with data ending June 2025, while the page says only that maintenance status is unclear (claim_findings[4], stale). The reviewer's status source is a search snippet and Ionic announced a Metal L2 deployment in June 2025, so the penalty is held at the bottom of the minor band and no status change is applied."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 74d3dba0-5f9b-45d8-b7c9-e857b7f32a06copy