Audit log

Every state-changing event for M2 Exchange: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-20 04:09:21Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 420,910,772

   sig

   4b19WNdkUUzW…JYKN93HLcopyexplorer ↗

   hash

   44ZcJojr3oLv…dr7QuVChcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (5322 B) ▸

   {"actor":"system:backfill","investigation_id":"26bce48e-5acc-4bbb-a451-cca47010ca11","kind":"publish","page_slug":"m2-exchange","published_at":"2026-05-20T04:09:21.219Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"M2 Exchange","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://beincrypto.com/learn/m2-review/"},{"credibility":3,"name":"","type":"other","url":"https://www.adgm.com/media/announcements/virtual-assets-trading-platform-m2-receives-financial-services-permission-from-adgm"},{"credibility":3,"name":"","type":"other","url":"https://www.fintechfutures.com/job-cuts-new-hires/crypto-platform-m2-reshuffles-leadership-with-ex-bitstamp-exec-james-greenwood-named-ceo"},{"credibility":3,"name":"","type":"other","url":"https://skynet.certik.com/projects/m2-exchange"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://cryptoslate.com/uaes-m2-crypto-exchange-hacked-for-13-7m-assures-full-fund-recovery/"},{"credibility":3,"name":"","type":"other","url":"https://www.quillaudits.com/blog/hack-analysis/m2-crypto-exchange-exploit"},{"credibility":3,"name":"","type":"other","url":"https://www.web3isgoinggreat.com/single/m2-hack"},{"credibility":3,"name":"","type":"other","url":"https://protos.com/crypto-exchange-m2-reimburses-victims-after-14m-halloween-hack/"},{"credibility":3,"name":"","type":"other","url":"https://www.cryptopolitan.com/m2-exchange-reports-hack-restores-13-7m-in-eth-sol-and-btc/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.adgm.com/media/announcements/virtual-assets-trading-platform-m2-receives-financial-services-permission-from-adgm"},{"credibility":3,"name":"","type":"other","url":"https://www.adgm.com/media/announcements/m2-secures-adgm-licence-and-plans-rollout-of-fully-regulated-crypto-services-to-uae"},{"credibility":3,"name":"","type":"other","url":"https://www.thenationalnews.com/business/money/2023/10/11/adgm-licensed-m2-crypto-platform-rolls-out-services-for-investors/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://beincrypto.com/learn/m2-review/"},{"credibility":3,"name":"","type":"other","url":"https://www.ccn.com/news/crypto/crypto-exchange-m2-security-breach/"},{"credibility":3,"name":"","type":"other","url":"https://www.quillaudits.com/blog/hack-analysis/m2-crypto-exchange-exploit"},{"credibility":3,"name":"","type":"other","url":"https://skynet.certik.com/projects/m2-exchange"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.quillaudits.com/blog/hack-analysis/m2-crypto-exchange-exploit"},{"credibility":3,"name":"","type":"other","url":"https://cryptoslate.com/uaes-m2-crypto-exchange-hacked-for-13-7m-assures-full-fund-recovery/"},{"credibility":3,"name":"","type":"other","url":"https://www.adgm.com/media/announcements/virtual-assets-trading-platform-m2-receives-financial-services-permission-from-adgm"},{"credibility":3,"name":"","type":"other","url":"https://www.fxleaders.com/news/2024/11/02/crypto-exchange-m2-recovers-13-7-million-after-breach-resolved-in-16-minutes/"}]}],"sources_used":[],"summary":"M2 Exchange is an Abu Dhabi-based centralized cryptocurrency exchange licensed by the ADGM FSRA that suffered a $13.7 million hot wallet breach on October 31, 2024, attributed to an access control vulnerability spanning Bitcoin, Ethereum, and Solana. The exchange claims to have covered all customer losses from company reserves within hours of the incident, though the lack of a public post-mortem and two CEO transitions within eighteen months raise unresolved transparency questions.","timeline":[{"date":"2023-08-16","event":"ADGM FSRA grants M2 Limited and M2 Custody Limited Financial Services Permission to operate an MTF and custody service in Abu Dhabi.","source":""},{"date":"2023-10-01","event":"M2 Exchange publicly launches retail and institutional services, initially offering BTC and ETH trading with AED fiat pairs.","source":""},{"date":"2024-10-15","event":"Stefan Kimmel steps down as CEO and moves to the M2 Board of Directors; Saadeddine Zaher appointed CEO.","source":""},{"date":"2024-10-31","event":"Attacker exploits hot wallet access control vulnerability at approximately 3:16 AM, draining ~$13.7M across Bitcoin, Ethereum, and Solana chains.","source":""},{"date":"2024-10-31","event":"M2 claims the breach was contained within 16 minutes; exchange covers all customer losses from company reserves and states services are restored.","source":""},{"date":"2024-11-01","event":"M2 issues public statement confirming the incident, stating cooperation with UAE legal and regulatory authorities and implementing enhanced security controls.","source":""},{"date":"2024-11-04","event":"On-chain analysts confirm approximately $10 million in ETH remains unmixed in the attacker's consolidation wallet; no attacker identified.","source":""},{"date":"2025-01-01","event":"James Greenwood, former CTOO of Bitstamp, named CEO of M2, marking a second CEO transition within the platform's first fifteen months.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 95e6d7b3-d4ca-4774-81ba-9c3e0812a368copy
2. #2rescoreby systemsystem

   2026-10-10 18:44:44Z
   Score: 38 → 53 (+15)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 38 → 53. Problems weighed by who is responsible: concerns that are not fraud −9.6, incidents the subject suffered −3.2, problems around the subject, caused by others −0.8; legitimacy credit long-running +2.
   anchoranchored

   chain

   ●mainnet-betaslot 455,364,455

   sig

   uhkGZqvpgfhW…GK9wLpTrcopyexplorer ↗

   hash

   FAaJ6xHMxFQP…6gLacKnVcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (642 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:44:44.818Z","decision":"rescore","investigation_id":"26bce48e-5acc-4bbb-a451-cca47010ca11","new_score":53,"page_slug":"m2-exchange","prev_score":38,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 38 → 53. Problems weighed by who is responsible: concerns that are not fraud −9.6, incidents the subject suffered −3.2, problems around the subject, caused by others −0.8; legitimacy credit long-running +2.","score_delta":15,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 9224b266-a39e-4aad-86f0-28668db32893copy
3. #3rescoreby systemsystem

   2026-11-01 23:15:45Z
   Score: 53 → 51 (-2)
   Re-read and rescored after the page was re-researched (2026-11-01). Rescored under Scoring v2, the published formula (avoid.net/scoring): 53 → 51. Problems weighed by who is responsible: incidents the subject suffered −12, concerns that are not fraud −7.6, problems around the subject, caused by others −1.6; legitimacy credit long-running +2, regulated +5.
   anchoranchored

   chain

   ●mainnet-betaslot 464,273,419

   sig

   MpG8sxXK3D5c…aB2oue1mcopyexplorer ↗

   hash

   3hjmtHAFq7GX…e5mNBMt5copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (723 B) ▸

   {"actor":"system","decided_at":"2026-11-01T23:15:44.720Z","decision":"rescore","investigation_id":"26bce48e-5acc-4bbb-a451-cca47010ca11","new_score":51,"page_slug":"m2-exchange","prev_score":53,"reason":"Re-read and rescored after the page was re-researched (2026-11-01). Rescored under Scoring v2, the published formula (avoid.net/scoring): 53 → 51. Problems weighed by who is responsible: incidents the subject suffered −12, concerns that are not fraud −7.6, problems around the subject, caused by others −1.6; legitimacy credit long-running +2, regulated +5.","score_delta":-2,"score_model":"v2","sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision b93cf41f-e5b0-4dc7-902f-0665bd0168f4copy
4. #4reviewby reviewerreviewer

   2026-11-01 23:16:51Z
   Score: 51 → 51 (no score change)
   The core incident facts (about $13.7M, assets, ADGM FSP in August 2023, about $10M ETH unmoved) match the sources I could read. One claim overstates its source: QuillAudits does not say MFA/multisig were absent. The attribution of first detection to Cyvers and ZachXBT was not found in the sources checked. Several cited sources were blocked or not checked, and no current-status problem was found.
   anchoranchored

   chain

   ●mainnet-betaslot 464,273,718

   sig

   5eApiNeSqESm…ztWn2qJVcopyexplorer ↗

   hash

   BAFF897nqCML…z9cXGKq7copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1209 B) ▸

   {"actor":"reviewer","artifact_identity":"1c6e5aea75725cb42379c5e54f52b275","decided_at":"2026-11-01T23:16:51.053Z","decision":"review","disputed_pct":0.2,"findings_hash":"5sRmREA2TTJ7Pkq4CTsf9g196rV5ZSqHYvmL63XcNish","investigation_id":"26bce48e-5acc-4bbb-a451-cca47010ca11","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":51,"page_content_hash":"48b2e6aa798410ae09dcb09e0ac655d1b645e320d6745a2a6009cc3d0d9ebaf0","page_slug":"m2-exchange","prev_score":51,"reason":"The core incident facts (about $13.7M, assets, ADGM FSP in August 2023, about $10M ETH unmoved) match the sources I could read. One claim overstates its source: QuillAudits does not say MFA/multisig were absent. The attribution of first detection to Cyvers and ZachXBT was not found in the sources checked. Several cited sources were blocked or not checked, and no current-status problem was found.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision e9f2bbdf-cf6b-49dc-bfa7-7590cae7ff4acopy
5. #5review reviseby judgejudge

   2026-11-01 23:16:51Z
   Score: 51 → 51 (no score change)
   Of 5 claims checked, 1 (20%) could not be verified: claim_findings[2], the statement that Cyvers and ZachXBT first detected the breach, was not found in the sources read, and ZachXBT appears in neither. Two more claims were only partly supported. claim_findings[0] says QuillAudits noted MFA and multi-sig were absent, but the source only recommends them. claim_findings[4] likely has the wrong month for the CEO change. The core incident figures (about $13.7M, assets, ADGM permission in August 2023) were confirmed. No shutdown, sanction or omission was found. The reviewer's confidence is low (0.5) and several cited sources were inaccessible, so the penalty is kept at the lower end of the minor band.
   anchoranchored

   chain

   ●mainnet-betaslot 464,273,723

   sig

   jCnS15PwaFwp…5LTVWfVFcopyexplorer ↗

   hash

   DTDhN4pBDE1o…UHkGMCNFcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1347 B) ▸

   {"actor":"judge","artifact_identity":"1c6e5aea75725cb42379c5e54f52b275","band_override":null,"decided_at":"2026-11-01T23:16:51.053Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.2,"investigation_id":"26bce48e-5acc-4bbb-a451-cca47010ca11","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":51,"page_slug":"m2-exchange","prev_score":51,"reason":"Of 5 claims checked, 1 (20%) could not be verified: claim_findings[2], the statement that Cyvers and ZachXBT first detected the breach, was not found in the sources read, and ZachXBT appears in neither. Two more claims were only partly supported. claim_findings[0] says QuillAudits noted MFA and multi-sig were absent, but the source only recommends them. claim_findings[4] likely has the wrong month for the CEO change. The core incident figures (about $13.7M, assets, ADGM permission in August 2023) were confirmed. No shutdown, sanction or omission was found. The reviewer's confidence is low (0.5) and several cited sources were inaccessible, so the penalty is kept at the lower end of the minor band.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 325478bb-ae58-4a9c-a212-88c5f7fd3ee7copy