Audit log

Every state-changing event for KyberSwap Elastic: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-20 15:41:06Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 421,014,705

   sig

   2DCefvXHKGWx…PZqscipAcopyexplorer ↗

   hash

   8U8x6duqNRPV…Q59eBNoDcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (7700 B) ▸

   {"actor":"system:backfill","investigation_id":"30c321e3-34ee-4e69-a4dc-f853a48f15bc","kind":"publish","page_slug":"kyberswap-elastic","published_at":"2026-05-20T15:41:06.296Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"KyberSwap Elastic","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/"},{"credibility":3,"name":"","type":"other","url":"https://www.chainsecurity.com/security-audit/kyberswap-elastic"},{"credibility":3,"name":"","type":"other","url":"https://docs.kyberswap.com/reference/legacy/audits"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/"},{"credibility":3,"name":"","type":"other","url":"https://blocksec.com/blog/yet-another-tragedy-of-precision-loss-an-in-depth-analysis-of-the-kyber-swap-incident-1"},{"credibility":3,"name":"","type":"other","url":"https://blocksec.com/blog/kyberswap-incident-masterful-exploitation-of-rounding-errors-with-exceedingly-subtle-calculations"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-kyberswap-hack-november-2023"},{"credibility":3,"name":"","type":"other","url":"https://rekt.news/kyberswap-rekt"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2023/11/24/kyberswap-offers-10-bounty-to-attacker-who-made-off-with-50m"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/kyberswap-dex-exploiter-bounty-negotiation-message-on-chain"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/kyberswap-hacker-bridges-stolen-funds"},{"credibility":3,"name":"","type":"other","url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://decrypt.co/208147/kyberswap-hacker-demands-company-control-unhinged-on-chain-ransom-letter"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/265429/kyber-hacker-control-message"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/kyberswap-hacker-demands-complete-control-over-kyber-company"},{"credibility":3,"name":"","type":"other","url":"https://bitcoinist.com/kyberswap-compensate-victims-deadline-gets-closer/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://blog.kyberswap.com/kyberswap-treasury-grant-program/"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/kyber-network-cuts-workforce-50-percent-following-november-exploit"},{"credibility":3,"name":"","type":"other","url":"https://crypto.news/kyberswap-laid-off-50-of-workforce-after-54m-elastic-exploit/"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap"},{"credibility":3,"name":"","type":"other","url":"https://www.justice.gov/usao-edny/pr/canadian-national-charged-stealing-approximately-65-million-cryptocurrency-two-defi"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/andean-medjedovic-kyberswap-alleged-hacker"},{"credibility":3,"name":"","type":"other","url":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-kyberswap-hack-november-2023"},{"credibility":3,"name":"","type":"other","url":"https://www.justice.gov/usao-edny/pr/canadian-national-charged-stealing-approximately-65-million-cryptocurrency-two-defi"},{"credibility":3,"name":"","type":"other","url":"https://blog.kyberswap.com/post-mortem-past-kyberswap-frontend-exploit-sept-2022/"},{"credibility":3,"name":"","type":"other","url":"https://blocksec.com/blog/yet-another-tragedy-of-precision-loss-an-in-depth-analysis-of-the-kyber-swap-incident-1"}]}],"sources_used":[],"summary":"KyberSwap Elastic is the concentrated liquidity automated market maker (AMM) component of Kyber Network, a decentralized exchange protocol deployed across more than a dozen EVM-compatible blockchains. On November 22–23, 2023, it suffered the largest DeFi exploit of that year — approximately $48–56 million drained via a precision rounding bug in its tick-crossing swap logic — after which the alleged attacker issued an on-chain ultimatum demanding full executive control of the company. Canadian national Andean Medjedovic was indicted by U.S. prosecutors in February 2025 on charges including wire fraud, computer hacking, and extortion; he remains a fugitive as of mid-2026.","timeline":[{"date":"2021-12-01","event":"KyberSwap Elastic concentrated liquidity protocol launches.","source":""},{"date":"2022-09-01","event":"KyberSwap suffers a separate frontend exploit; no user funds reported lost from smart contracts.","source":""},{"date":"2023-05-01","event":"Hardened KyberSwap Elastic contracts re-deployed following a vulnerability disclosure and ChainSecurity audit; no funds lost during upgrade.","source":""},{"date":"2023-11-22","event":"Exploit begins; attacker drains approximately $48–56 million from KyberSwap Elastic pools across Arbitrum, Optimism, Ethereum, Polygon, Base, and Avalanche using a flash loan and precision rounding bug.","source":""},{"date":"2023-11-23","event":"KyberNetwork confirms the security incident. Liquidity additions suspended across all Elastic pools. Attacker posts on-chain message: 'Negotiations will start in a few hours when I am fully rested.'","source":""},{"date":"2023-11-24","event":"KyberSwap offers the attacker a 10% bounty (~$4.6M) in exchange for return of 90% of stolen funds.","source":""},{"date":"2023-11-29","event":"Attacker posts on-chain warning against legal threats, escalating the standoff.","source":""},{"date":"2023-11-30","event":"Attacker publishes extended on-chain ultimatum demanding full executive and DAO control of Kyber Network, setting a December 10 deadline.","source":""},{"date":"2023-12-02","event":"KyberSwap announces Treasury Grant Program to compensate victims, declining to meet the attacker's demands.","source":""},{"date":"2023-12-10","event":"Attacker's deadline passes; no resolution. Funds are not returned.","source":""},{"date":"2023-12-20","event":"KyberSwap Treasury Grant Program opens; offers 60% (3-month vesting) or 100% (12-month vesting) compensation in USD stablecoins to approximately 2,367 affected liquidity providers.","source":""},{"date":"2023-12-24","event":"Kyber Network CEO Victor Tran announces 50% workforce reduction. Liquidity protocol and KyberAI paused.","source":""},{"date":"2024-01-01","event":"Andean Medjedovic, a Canadian national, is held in Belgrade, Serbia for approximately 105 days following an Interpol Red Notice, but is released after a Serbian court declines to extradite him.","source":""},{"date":"2025-02-03","event":"U.S. DOJ unseals indictment against Canadian national Andean Medjedovic, 22, charging him with wire fraud, computer hacking, attempted extortion, and money laundering for alleged $65M in hacks of KyberSwap and Indexed Finance. Medjedovic remains a fugitive.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 57c47f39-b48a-4f88-923f-467d21d63bb9copy
2. #2rescoreby systemsystem

   2026-10-10 18:48:35Z
   Score: 10 → 57 (+47)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 57. Problems weighed by who is responsible: incidents the subject suffered −12.8, problems around the subject, caused by others −1.6; legitimacy credit long-running +6.
   anchoranchored

   chain

   ●mainnet-betaslot 455,368,436

   sig

   HGgXKX5ikYg3…fhmrnq42copyexplorer ↗

   hash

   Ec5g9RK4Gjed…YaHXfV5mcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (615 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:48:35.019Z","decision":"rescore","investigation_id":"30c321e3-34ee-4e69-a4dc-f853a48f15bc","new_score":57,"page_slug":"kyberswap-elastic","prev_score":10,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 57. Problems weighed by who is responsible: incidents the subject suffered −12.8, problems around the subject, caused by others −1.6; legitimacy credit long-running +6.","score_delta":47,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision eb0d228a-93e0-421e-85ed-d94172665e28copy
3. #3reviewby reviewerreviewer

   2026-11-02 09:39:53Z
   Score: 57 → 57 (no score change)
   The core facts hold: the Nov 22, 2023 exploit, the $55.2M and 2,367 LP figures, the recovery totals, the 13 chains, the grant options and the DOJ indictment all match what I could read. Problems found: an unsupported 'largest DeFi exploit of that year' superlative, an inconsistent grant program date (Dec 2 versus Dec 20), and an unconfirmed 105-day detention figure. Several cited URLs could not be read, so many details remain unchecked. Current subject status is unknown.
   anchoranchored

   chain

   ●mainnet-betaslot 464,448,261

   sig

   3XR4hyRV5z2F…Fq1kuDa9copyexplorer ↗

   hash

   NWaX4wuQTmwT…7R3T3B3ncopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1327 B) ▸

   {"actor":"reviewer","artifact_identity":"dd916cc320f6b3a67f52bbcde876f710","decided_at":"2026-11-02T09:39:53.750Z","decision":"review","disputed_pct":0.2,"findings_hash":"2mKoMgHWiE5gB5prUyQg7eRAwK4a3yjiHD2244pCf3gv","investigation_id":"30c321e3-34ee-4e69-a4dc-f853a48f15bc","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":57,"omissions":{"material":0,"total":1},"page_content_hash":"e1b3b08956f27f3412b547f701a12fe5c66e3c31f89f1ed1ef6488660e49a758","page_slug":"kyberswap-elastic","prev_score":57,"reason":"The core facts hold: the Nov 22, 2023 exploit, the $55.2M and 2,367 LP figures, the recovery totals, the 13 chains, the grant options and the DOJ indictment all match what I could read. Problems found: an unsupported 'largest DeFi exploit of that year' superlative, an inconsistent grant program date (Dec 2 versus Dec 20), and an unconfirmed 105-day detention figure. Several cited URLs could not be read, so many details remain unchecked. Current subject status is unknown.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":3,"subject_status":"unknown","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision af44ef46-58f4-436b-88c7-d9e3fa92bde9copy
4. #4review reviseby judgejudge

   2026-11-02 09:39:54Z
   Score: 57 → 57 (no score change)
   The core facts hold: the $55.2M and 2,367 LP figures, recovery totals, 13 chains, grant options and the DOJ indictment match primary or corroborating sources (claim_findings[0-3], [8]). Two of ten claims could not be verified (20%): the 'largest DeFi exploit of that year' superlative in the summary has no supporting source and is likely wrong (claim_findings[5]), and the 50% layoff claim cites a dead Cointelegraph link (claim_findings[6]). The page also gives the treasury grant start as December 2 in one place and December 20 in another (claim_findings[4]), and the 105-day detention figure is unconfirmed (claim_findings[7]). The reviewer's confidence was moderate and several sources could not be read, so the penalty is kept in the lower part of the minor band.
   anchoranchored

   chain

   ●mainnet-betaslot 464,448,266

   sig

   WbMLmxZb8JUc…YbjTHiubcopyexplorer ↗

   hash

   7jD815gDA3mn…mC3gCzGCcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1418 B) ▸

   {"actor":"judge","artifact_identity":"dd916cc320f6b3a67f52bbcde876f710","band_override":null,"decided_at":"2026-11-02T09:39:53.750Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.2,"investigation_id":"30c321e3-34ee-4e69-a4dc-f853a48f15bc","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":57,"page_slug":"kyberswap-elastic","prev_score":57,"reason":"The core facts hold: the $55.2M and 2,367 LP figures, recovery totals, 13 chains, grant options and the DOJ indictment match primary or corroborating sources (claim_findings[0-3], [8]). Two of ten claims could not be verified (20%): the 'largest DeFi exploit of that year' superlative in the summary has no supporting source and is likely wrong (claim_findings[5]), and the 50% layoff claim cites a dead Cointelegraph link (claim_findings[6]). The page also gives the treasury grant start as December 2 in one place and December 20 in another (claim_findings[4]), and the 105-day detention figure is unconfirmed (claim_findings[7]). The reviewer's confidence was moderate and several sources could not be read, so the penalty is kept in the lower part of the minor band.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 867f2acf-c606-4f1e-b35b-9dbe89c31894copy