Audit log

Every state-changing event for Kokomo Finance: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-28 03:34:41Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,639,370

   sig

   3u2HmEDfCj7h…RzvhNBGEcopyexplorer ↗

   hash

   J52DtyrvidVC…eZ7Pd2Dbcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (4834 B) ▸

   {"actor":"system:backfill","investigation_id":"ed476fa4-a1d0-4e7c-b5e4-86aae5387691","kind":"publish","page_slug":"kokomo-finance","published_at":"2026-05-28T03:34:40.873Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Kokomo Finance","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/tech/2023/03/27/crypto-lender-kokomos-developers-use-wrapped-bitcoin-for-4m-exit-scam","type":"other","url":""},{"credibility":3,"name":"https://www.certik.com/resources/blog/kokomo-finance","type":"other","url":""},{"credibility":3,"name":"https://cryptopotato.com/optimism-defi-protocol-kokomo-finance-rug-pulls-users-for-4-million/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.certik.com/resources/blog/kokomo-finance","type":"other","url":""},{"credibility":3,"name":"https://cryptopotato.com/optimism-defi-protocol-kokomo-finance-rug-pulls-users-for-4-million/","type":"other","url":""},{"credibility":3,"name":"https://medium.com/coinmonks/decoding-kokomo-finance-4-million-rug-pull-quillaudits-d5d027522bf3","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.certik.com/resources/blog/kokomo-finance","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/4m-exit-scam-suspected-as-kokomo-finance-flies-off-radar-token-plunges","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/tech/2023/03/27/crypto-lender-kokomos-developers-use-wrapped-bitcoin-for-4m-exit-scam","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.cryptometer.io/news/zachxbt-exposes-scam-ring-behind-multiple-defi-rug-pulls/","type":"other","url":""},{"credibility":3,"name":"https://cryptopotato.com/warning-malicious-group-threatening-layer-2-networks-exposed/","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/scam-crypto-projects-liquidity-disappear","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/crypto-sleuth-warns-scammers-defi-protocol","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.certik.com/resources/blog/kokomo-finance","type":"other","url":""},{"credibility":3,"name":"https://cryptopotato.com/optimism-defi-protocol-kokomo-finance-rug-pulls-users-for-4-million/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/tech/2023/03/27/crypto-lender-kokomos-developers-use-wrapped-bitcoin-for-4m-exit-scam","type":"other","url":""},{"credibility":3,"name":"https://coingeek.com/kokomo-finance-developers-pull-off-4m-exit-scam-days-after-launch-report/","type":"other","url":""}]}],"sources_used":[],"summary":"Kokomo Finance was a purported non-custodial lending and borrowing protocol launched on the Optimism blockchain on March 25, 2023. Within approximately 24 hours of launch, its developers executed a deliberate exit scam, stealing approximately $4 to $4.5 million in user funds through smart contract manipulation. The project was subsequently linked by on-chain investigator ZachXBT to a serial scam ring responsible for over $20 million in losses across multiple DeFi protocols.","timeline":[{"date":"2023-03-25","event":"Kokomo Finance launches on Optimism, offering non-custodial lending and borrowing of WBTC, ETH, USDT, USDC, DAI, and native KOKO token.","source":""},{"date":"2023-03-26","event":"Developers execute exit scam: deployer address 0x41be deploys malicious cBTC contract, manipulates reward functions, drains approximately $4–4.5 million in user funds across Optimism, Arbitrum, and BSC. KOKO token crashes ~97%. Website and all social media accounts deleted.","source":""},{"date":"2023-03-26","event":"CertiK publicly flags the incident via its alert system, identifying the attack as an exit scam and the largest rug pull observed on Optimism at that time.","source":""},{"date":"2023-03-31","event":"CertiK publishes full post-mortem analysis, documenting technical attack flow, wallet addresses, and fund distribution across chains.","source":""},{"date":"2023-11-01","event":"ZachXBT issues warning about Lendora Protocol on Scroll network, connecting it to the same scam group behind Kokomo Finance, Magnate, and Solfire.","source":""},{"date":"2024-04-14","event":"ZachXBT publicly exposes Leaper Finance on Blast as the scam ring's latest operation, seeded with ~$1 million laundered from prior scams. Total ring losses identified exceed $20 million. Scammers taunt ZachXBT on X before deactivating accounts.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 8a4b210f-273b-447f-9a67-58e2e9627dffcopy
2. #2rescoreby systemsystem

   2026-10-27 06:05:13Z
   Score: 2 → 0 (-2)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 2 → 0. The page establishes that the subject is itself a scheme, so the score is 0.
   anchoranchored

   chain

   ●mainnet-betaslot 461,965,115

   sig

   3hLqqqDTaSak…DW3bAkzDcopyexplorer ↗

   hash

   3QZr1DgDvhf8…9WRUZ6MKcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (520 B) ▸

   {"actor":"system","decided_at":"2026-10-27T06:05:13.383Z","decision":"rescore","investigation_id":"ed476fa4-a1d0-4e7c-b5e4-86aae5387691","new_score":0,"page_slug":"kokomo-finance","prev_score":2,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 2 → 0. The page establishes that the subject is itself a scheme, so the score is 0.","score_delta":-2,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 7bcdcec2-8b8e-4dda-82a3-2f594c07ce34copy
3. #3reviewby reviewerreviewer

   2026-10-28 00:54:20Z
   Score: 0 → 0 (no score change)
   The core incident (launch, exit scam, about $4-4.5M loss, ice phishing mechanism, TVL collapse, cross-chain distribution) and the ZachXBT scam-ring narrative are well supported by CertiK, CoinDesk and CryptoPotato. Issues are minor. The 0xGuard audit and 45% mint claim is not in the sources I could read, the Vital Block detail was not found, 141.7 WBTC should be 141, and the 'largest rug pull on Optimism' claim is broader than CertiK's 'largest incident on Optimism in 2023'. Timeline entries are unsourced. No critical omissions were found.
   anchoranchored

   chain

   ●mainnet-betaslot 462,280,827

   sig

   32UKW3kjbA2V…N547VYstcopyexplorer ↗

   hash

   Cx6dCW3TnMJg…aFEdvcLNcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1359 B) ▸

   {"actor":"reviewer","artifact_identity":"4af1aad70c2dc283d73db9a92a7b668e","decided_at":"2026-10-28T00:54:20.724Z","decision":"review","disputed_pct":0.3077,"findings_hash":"7Lcozwv7ohtJCYpgqMZgdECEioWBos6DhYRHbuuMfRn","investigation_id":"ed476fa4-a1d0-4e7c-b5e4-86aae5387691","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":0,"page_content_hash":"5fb2cc2c09853e9906be75098eee0c119c5be9e005b62703bb934e0245fbaa76","page_slug":"kokomo-finance","prev_score":0,"reason":"The core incident (launch, exit scam, about $4-4.5M loss, ice phishing mechanism, TVL collapse, cross-chain distribution) and the ZachXBT scam-ring narrative are well supported by CertiK, CoinDesk and CryptoPotato. Issues are minor. The 0xGuard audit and 45% mint claim is not in the sources I could read, the Vital Block detail was not found, 141.7 WBTC should be 141, and the 'largest rug pull on Optimism' claim is broader than CertiK's 'largest incident on Optimism in 2023'. Timeline entries are unsourced. No critical omissions were found.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":3,"subject_status":"shut_down","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 324bb242-7095-4a67-8a2c-63671f60c3b1copy
4. #4review reviseby judgejudge

   2026-10-28 00:54:20Z
   Score: 0 → 0 (no score change)
   The core incident is well supported: launch and exit scam dates, the $4-4.5M loss, the ice-phishing mechanics, the TVL collapse, fund distribution and the ZachXBT scam-ring narrative were confirmed against CertiK, CoinDesk and CryptoPotato (claim_findings[0,1,4,5,8]). No claim was disputed. Four of 13 claims (30.8%) could not be verified: the 0xGuard audit and 45% mint detail (claim_findings[2], repeated in sections[4]), the Vital Block detail (claim_findings[9]), the Lendora date (claim_findings[10]) and the recovery status (claim_findings[11]). Four others are partly supported and need small wording fixes: 141.7 WBTC should be 141, 'largest rug pull on Optimism' should be 'largest incident on Optimism in 2023', and the KOKO starting price is inconsistent across sources. The page is rated at the top of the minor-issues band rather than the significant band because the percentage sits just over the 30% line, nothing was contradicted, and the unverified items are missing sources rather than evidence against the page. The timeline entries all lack sources.
   anchoranchored

   chain

   ●mainnet-betaslot 462,280,832

   sig

   51Bh17wHLuPi…roc6LGfecopyexplorer ↗

   hash

   HBbVrpEjUkuJ…DAm1C8yKcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1716 B) ▸

   {"actor":"judge","artifact_identity":"4af1aad70c2dc283d73db9a92a7b668e","band_override":null,"decided_at":"2026-10-28T00:54:20.724Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.3077,"investigation_id":"ed476fa4-a1d0-4e7c-b5e4-86aae5387691","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":0,"page_slug":"kokomo-finance","prev_score":0,"reason":"The core incident is well supported: launch and exit scam dates, the $4-4.5M loss, the ice-phishing mechanics, the TVL collapse, fund distribution and the ZachXBT scam-ring narrative were confirmed against CertiK, CoinDesk and CryptoPotato (claim_findings[0,1,4,5,8]). No claim was disputed. Four of 13 claims (30.8%) could not be verified: the 0xGuard audit and 45% mint detail (claim_findings[2], repeated in sections[4]), the Vital Block detail (claim_findings[9]), the Lendora date (claim_findings[10]) and the recovery status (claim_findings[11]). Four others are partly supported and need small wording fixes: 141.7 WBTC should be 141, 'largest rug pull on Optimism' should be 'largest incident on Optimism in 2023', and the KOKO starting price is inconsistent across sources. The page is rated at the top of the minor-issues band rather than the significant band because the percentage sits just over the 30% line, nothing was contradicted, and the unverified items are missing sources rather than evidence against the page. The timeline entries all lack sources.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 063ace2e-505c-4d60-8106-75a0d2a3d829copy