Audit log

Every state-changing event for LendHub: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-28 16:22:06Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,755,653

   sig

   2gSnKKb8qAwZ…RY9crxHKcopyexplorer ↗

   hash

   5Qb6MVE8yiKp…dJHayoD4copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6213 B) ▸

   {"actor":"system:backfill","investigation_id":"ec31964a-e60e-4b74-8653-c508cbe10f02","kind":"publish","page_slug":"lendhub","published_at":"2026-05-28T16:22:06.724Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"LendHub","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-lendhub-hack-january-2023","type":"other","url":""},{"credibility":3,"name":"https://www.certik.com/resources/blog/1IDWJfEBm6GK5sIIdfhfQn-lendhub-incident-analysis","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/lendhub","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cryptopotato.com/lendhub-exploiter-moves-proceeds-to-tornadocash/","type":"other","url":""},{"credibility":3,"name":"https://www.certik.com/resources/blog/1IDWJfEBm6GK5sIIdfhfQn-lendhub-incident-analysis","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.theblock.co/post/202047/self-proclaimed-safest-defi-lender-loses-6-million-in-hack","type":"other","url":""},{"credibility":3,"name":"https://coincodecap.com/lendhub-the-safest-defi-lender-loses-6-million-in-a-hack","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://defillama.com/protocol/lendhub","type":"other","url":""},{"credibility":3,"name":"https://crypto.news/the-heco-chain-announced-its-official-retirement-urging-users-to-convert-and-redeem-their-assets/","type":"other","url":""},{"credibility":3,"name":"https://crypto.news/lendhub-loses-6m-to-hackers/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://hecochain.medium.com/introducing-lendhub-hecos-fastest-growing-lending-protocol-7716895a06c","type":"other","url":""},{"credibility":3,"name":"https://www.huobi.com/support/en-us/detail/104874608555069","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.certik.com/resources/blog/1IDWJfEBm6GK5sIIdfhfQn-lendhub-incident-analysis","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-lendhub-hack-january-2023","type":"other","url":""}]}],"sources_used":[{"credibility":2,"name":"Explained: The LendHub Hack (January 2023) — Halborn","type":"research","url":"https://www.halborn.com/blog/post/explained-the-lendhub-hack-january-2023"},{"credibility":2,"name":"Lendhub Incident Analysis — CertiK","type":"research","url":"https://www.certik.com/resources/blog/1IDWJfEBm6GK5sIIdfhfQn-lendhub-incident-analysis"},{"credibility":1,"name":"Self-proclaimed 'safest' DeFi lender loses $6 million in hack — The Block","type":"news_article","url":"https://www.theblock.co/post/202047/self-proclaimed-safest-defi-lender-loses-6-million-in-hack"},{"credibility":2,"name":"Lendhub protocol exploiters spotted shifting $3.85M into Tornado Cash — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/lendhub-protocol-exploiters-spotted-shifting-3-85m-into-tornado-cash"},{"credibility":2,"name":"Lendhub Exploiter Moves Proceeds to TornadoCash — CryptoPotato","type":"news_article","url":"https://cryptopotato.com/lendhub-exploiter-moves-proceeds-to-tornadocash/"},{"credibility":2,"name":"LendHub loses $6m to hackers — Crypto.news","type":"news_article","url":"https://crypto.news/lendhub-loses-6m-to-hackers/"},{"credibility":2,"name":"LendHub — DefiLlama (TVL and protocol status)","type":"on_chain","url":"https://defillama.com/protocol/lendhub"},{"credibility":2,"name":"Introducing LendHub — HECO Chain Medium","type":"official","url":"https://hecochain.medium.com/introducing-lendhub-hecos-fastest-growing-lending-protocol-7716895a06c"},{"credibility":2,"name":"HECO Chain retirement announcement — Crypto.news","type":"news_article","url":"https://crypto.news/the-heco-chain-announced-its-official-retirement-urging-users-to-convert-and-redeem-their-assets/"},{"credibility":2,"name":"Hackers of Crypto Platform Lendhub Move $3.85 Million Into Tornado Cash — Bitcoinist","type":"news_article","url":"https://bitcoinist.com/lendhub-hackers-move-3-85-million-in-crypto/"}],"summary":"LendHub was a decentralized cross-chain lending protocol operating primarily on the Huobi Eco Chain (HECO) and Binance Smart Chain (BSC). On January 12, 2023, the protocol suffered an approximately $6 million exploit caused by an operational failure to remove a deprecated IBSV cToken from its market, allowing an attacker to drain funds by arbitraging the two coexisting token versions. The protocol's TVL collapsed to near zero following the exploit, stolen funds were laundered through Tornado Cash, and the protocol is no longer considered operational.","timeline":[{"date":"2021-05-06","event":"LendHub launched on Huobi Global and promoted as HECO chain's fastest-growing lending protocol.","source":""},{"date":"2023-01-11","event":"The exploiter received 100 ETH from Tornado Cash on Ethereum and began staging the attack.","source":""},{"date":"2023-01-12","event":"LendHub exploited for approximately $6 million via deprecated IBSV cToken arbitrage vulnerability. TVL collapsed from $6 million to $90,305.","source":""},{"date":"2023-01-13","event":"LendHub acknowledged the exploit via Twitter. SlowMist, CertiK, and Halborn published analyses.","source":""},{"date":"2023-01-12","event":"Over 1,100 ETH (~$1.79 million) transferred to Tornado Cash within hours of the exploit.","source":""},{"date":"2023-02-27","event":"PeckShield and Beosin alert that a further 2,415 ETH (~$3.85 million) was moved to Tornado Cash from the attacker wallet, bringing the total laundered amount to approximately $5.7 million.","source":""},{"date":"2024-11-10","event":"HECO chain announced official retirement; users urged to convert and redeem assets by January 10, 2025.","source":""},{"date":"2025-01-10","event":"HECO chain redemption deadline passed. LendHub TVL reached $0 on DefiLlama; protocol considered effectively defunct.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 47cb0f8f-217e-4cc1-8f3f-4e50c66792a8copy
2. #2rescoreby systemsystem

   2026-10-10 18:43:15Z
   Score: 18 → 50 (+32)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 18 → 50. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −6.4, problems around the subject, caused by others −1.6; legitimacy credit long-running +6; no longer operating, so capped at 50.
   anchoranchored

   chain

   ●mainnet-betaslot 455,363,328

   sig

   2hpZK5ubg2FV…NJc1TkQGcopyexplorer ↗

   hash

   9Q7uRJaV6kDQ…KbkrBb3icopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (676 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:43:15.781Z","decision":"rescore","investigation_id":"ec31964a-e60e-4b74-8653-c508cbe10f02","new_score":50,"page_slug":"lendhub","prev_score":18,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 18 → 50. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −6.4, problems around the subject, caused by others −1.6; legitimacy credit long-running +6; no longer operating, so capped at 50.","score_delta":32,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 56535554-0dc6-4c0b-a872-6ce1216fde89copy
3. #3reviewby reviewerreviewer

   2026-11-01 23:32:52Z
   Score: 50 → 50 (no score change)
   The core facts hold: the Jan 12, 2023 exploit of about $6M from a retained deprecated IBSV cToken, the Halborn quote, the Tornado Cash flows on Feb 27, and the protocol's deprecated status. Several specifics were not found in fetched sources: HBSV/HDOT, the $90,305 TVL, and the 2023-01-11 date. The USD value of the 1,100 ETH differs from other outlets. The HECO announcement date appears to be the snapshot date, and the Halborn analysis is dated Jan 19, not Jan 13. No contradiction with the subject's current status was found.
   anchoranchored

   chain

   ●mainnet-betaslot 464,278,188

   sig

   4fy3hXi445rY…tN6QQRtycopyexplorer ↗

   hash

   CHLxsaPWxdPJ…8soK4qRDcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1377 B) ▸

   {"actor":"reviewer","artifact_identity":"e62d5bccf831d6c487a1c6b354fd1881","decided_at":"2026-11-01T23:32:51.996Z","decision":"review","disputed_pct":0.1818,"findings_hash":"4SuomaUTFvSbthnE3UfUtvVnTAvYqhUAJuqLiURGFfXF","investigation_id":"ec31964a-e60e-4b74-8653-c508cbe10f02","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":50,"omissions":{"material":0,"total":1},"page_content_hash":"27415b8d1ce435df883acdedf02b6809bd08fd5b38a362d66cbb40afc805c58c","page_slug":"lendhub","prev_score":50,"reason":"The core facts hold: the Jan 12, 2023 exploit of about $6M from a retained deprecated IBSV cToken, the Halborn quote, the Tornado Cash flows on Feb 27, and the protocol's deprecated status. Several specifics were not found in fetched sources: HBSV/HDOT, the $90,305 TVL, and the 2023-01-11 date. The USD value of the 1,100 ETH differs from other outlets. The HECO announcement date appears to be the snapshot date, and the Halborn analysis is dated Jan 19, not Jan 13. No contradiction with the subject's current status was found.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":3,"subject_status":"shut_down","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 55267d68-974d-4bcd-800c-ef861d5b0ccbcopy
4. #4review reviseby judgejudge

   2026-11-01 23:32:52Z
   Score: 50 → 50 (no score change)
   The core facts hold: the January 12, 2023 exploit of about $6 million, the Halborn quote, the February 27 Tornado Cash transfer and the protocol's deprecated status were all confirmed (claim_findings[0], [2], [4], [9]). Two of 11 claims (about 18%) could not be found in any fetched source: the HBSV/HDOT token names (claim_findings[1]) and the $90,305 TVL figure (claim_findings[8]). Four more claims were only partly supported: the dollar value of the 1,100 ETH, the 2023-01-11 staging date, the 2023-01-13 date for the security analyses, and the 2024-11-10 HECO announcement date, which looks like a snapshot date. No omission above minor severity was found and the page does not contradict the protocol's shut-down status, so a small penalty and minor-issues banner are applied.
   anchoranchored

   chain

   ●mainnet-betaslot 464,278,192

   sig

   gPKuET8QiJtR…CsXMZ4eucopyexplorer ↗

   hash

   7Xvy4ejr5nU7…UUmCbvRvcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1423 B) ▸

   {"actor":"judge","artifact_identity":"e62d5bccf831d6c487a1c6b354fd1881","band_override":null,"decided_at":"2026-11-01T23:32:51.996Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.1818,"investigation_id":"ec31964a-e60e-4b74-8653-c508cbe10f02","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":50,"page_slug":"lendhub","prev_score":50,"reason":"The core facts hold: the January 12, 2023 exploit of about $6 million, the Halborn quote, the February 27 Tornado Cash transfer and the protocol's deprecated status were all confirmed (claim_findings[0], [2], [4], [9]). Two of 11 claims (about 18%) could not be found in any fetched source: the HBSV/HDOT token names (claim_findings[1]) and the $90,305 TVL figure (claim_findings[8]). Four more claims were only partly supported: the dollar value of the 1,100 ETH, the 2023-01-11 staging date, the 2023-01-13 date for the security analyses, and the 2024-11-10 HECO announcement date, which looks like a snapshot date. No omission above minor severity was found and the page does not contradict the protocol's shut-down status, so a small penalty and minor-issues banner are applied.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision c62c4578-a376-471f-9961-d9d295478962copy