Audit log

Every state-changing event for Monero: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.

1. #1publishby system:backfill

   2026-05-14 06:02:29Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 419,628,900

   sig

   4YcAEcVk3bNC…MPJkiBeEcopyexplorer ↗

   hash

   DsA3nwNKJzyT…MgHqRATKcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (12062 B) ▸

   {"actor":"system:backfill","investigation_id":"ab69b864-4fd5-4abf-8bcb-9c6f65db0c25","kind":"publish","page_slug":"monero","published_at":"2026-05-14T06:02:29.200Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Monero","sections":[{"content":"Monero launched in April 2014 as a fork of Bytecoin, using the CryptoNote protocol. It employs ring signatures, stealth addresses, and RingCT for transaction privacy. No premine, fully open-source, community-funded via the Community Crowdfunding System (CCS). No VC backing.","heading":"Project Overview and Technical Architecture","severity":"low","sources":[{"credibility":2,"name":"Monero - Wikipedia","type":"other","url":"https://en.wikipedia.org/wiki/Monero"},{"credibility":2,"name":"Monero Official Site","type":"official","url":"https://www.getmonero.org/"}]},{"content":"Former lead maintainer Riccardo Spagni (fluffypony) faces 378 counts of fraud/forgery/uttering in South Africa. He was arrested in the U.S. in 2021 and extradited in 2022. The charges pre-date his involvement with Monero and relate to alleged corporate fraud at a prior employer.","heading":"Founder Legal Issues (Spagni/fluffypony)","severity":"high","sources":[{"credibility":2,"name":"CoinDesk: Fluffypony Arrested","type":"news_article","url":"https://www.coindesk.com/markets/2021/08/02/former-monero-maintainer-fluffypony-arrested-and-to-be-extradited-for-non-crypto-crimes"},{"credibility":2,"name":"CoinGeek: Spagni 378 Fraud Charges","type":"news_article","url":"https://coingeek.com/moneros-riccardo-spagni-charged-with-378-charges-of-fraud-and-forgery-in-south-africa/"},{"credibility":2,"name":"News24: Fluffypony Extradition","type":"news_article","url":"https://www.news24.com/business/companies/crypto-developer-fluffypony-to-be-extradited-to-sa-to-face-r14-million-fraud-charge-20220602"}]},{"content":"Archetyp Market ($267M, Monero-exclusive) was dismantled by DOJ/Europol in June 2025. OFAC sanctioned Nemesis Market Monero addresses in March 2025. Monero is the dominant payment method on remaining darknet markets due to its privacy features.","heading":"Darknet Market Use","severity":"critical","sources":[{"credibility":2,"name":"TRM Labs: Archetyp Market Takedown","type":"research","url":"https://www.trmlabs.com/resources/blog/europol-leads-international-takedown-of-longest-running-darknet-market-archetyp"},{"credibility":2,"name":"CryptoSlate: DOJ/Europol Seize Archetyp","type":"news_article","url":"https://cryptoslate.com/us-doj-europol-seize-worlds-largest-dark-web-drug-market-operating-via-monero/"},{"credibility":2,"name":"The Block: OFAC Sanctions Nemesis Monero Addresses","type":"news_article","url":"https://www.theblock.co/post/344583/ofac-sanctions-bitcoin-monero-addresses-darknet-nemesis"},{"credibility":2,"name":"Chainalysis: OFAC Nemesis Designation","type":"research","url":"https://www.chainalysis.com/blog/ofac-designation-iran-darknet-markets-bitcoin-fentanyl-march-2025/"}]},{"content":"$330M BTC theft was laundered via XMR swap in April 2025 (identified by ZachXBT). A $282M theft was also laundered via XMR in January 2025. 18 individuals were arrested in Japan for Monero-based money laundering operations.","heading":"Money Laundering Incidents","severity":"critical","sources":[{"credibility":2,"name":"CoinDesk: $330M BTC Hacker and Monero","type":"news_article","url":"https://www.coindesk.com/business/2025/04/29/did-the-usd330m-btc-hacker-deliberatley-pump-monero-to-make-even-more-money"},{"credibility":2,"name":"CoinDesk: Monero Price Surge Attributable to Large Hack","type":"news_article","url":"https://www.coindesk.com/markets/2025/04/28/monero-price-surge-likely-attributable-to-large-hack-zachxbt"},{"credibility":1,"name":"Bloomberg: Darknet Demand for Monero Rises","type":"news_article","url":"https://www.bloomberg.com/news/articles/2026-02-13/darknet-demand-for-monero-xmr-rises-stumping-crime-fighters"}]},{"content":"Binance delisted Monero in February 2024. Kraken delisted in the EEA in October 2024. OKX and 60+ other exchanges have also delisted XMR. The EU Anti-Money Laundering Regulation (AMLR) bans crypto-asset service providers from handling privacy coins by July 2027.","heading":"Regulatory Actions and Delistings","severity":"high","sources":[{"credibility":2,"name":"CoinDesk: Binance to Delist Monero","type":"news_article","url":"https://www.coindesk.com/markets/2024/02/06/binance-to-delist-monero-privacy-token-xmr-slides"},{"credibility":2,"name":"Crypto Briefing: Kraken EEA Delisting","type":"news_article","url":"https://cryptobriefing.com/kraken-monero-delisting-eea/"},{"credibility":2,"name":"The Defiant: EU AML Rules Ban Privacy Coins","type":"news_article","url":"https://thedefiant.io/news/regulation/eu-aml-rules-to-ban-anonymous-accounts-privacy-coins"},{"credibility":1,"name":"Binance: Official XMR Delisting","type":"official","url":"https://www.binance.com/en/support/announcement/detail/f73b083ba6834771b07dbe5319917ae5"}]},{"content":"The IRS offered $1.25M in bounties for Monero tracing tools. CipherTrace filed patents for probabilistic deanonymization. Tracing remains probabilistic rather than deterministic, unlike Bitcoin's fully transparent ledger.","heading":"Law Enforcement Tracing Efforts","severity":"medium","sources":[{"credibility":2,"name":"Decrypt: IRS $1.25M Monero Bounties","type":"news_article","url":"https://decrypt.co/43451/irs-1-million-contracts-data-firms-crack-monero"}]},{"content":"Over 3,500 sites were infected with Monero mining malware in 2024-2025. In 2019, the official Monero website binary was confirmed to have been compromised with coin-stealing malware.","heading":"Cryptojacking and Malware","severity":"high","sources":[{"credibility":2,"name":"Decrypt: Cryptojacking Hits 3,500+ Sites","type":"news_article","url":"https://decrypt.co/331195/cryptojacking-resurfaces-as-monero-miner-malware-hits-3500-sites-report"},{"credibility":2,"name":"BleepingComputer: Monero Binary Coin Stealer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/coin-stealer-found-in-monero-linux-binaries-from-official-site/"}]},{"content":"All-time high of $799.89 in January 2026. Thin liquidity post-delistings makes price manipulation risk elevated. Current market cap ~$7.6B.","heading":"Market Dynamics","severity":"medium","sources":[{"credibility":2,"name":"CoinMarketCap: Monero","type":"other","url":"https://coinmarketcap.com/currencies/monero/"}]},{"content":"Monero ownership and use is legal in the U.S. and EU at the individual level. The project has no VC backing and is funded entirely by community donations. Privacy advocates and journalists in authoritarian regimes use Monero for legitimate financial privacy.","heading":"Legitimate Privacy Use Cases","severity":"low","sources":[{"credibility":2,"name":"Monero Official Site","type":"official","url":"https://www.getmonero.org/"}]}],"sources_used":[{"credibility":2,"name":"Monero - Wikipedia","type":"other","url":"https://en.wikipedia.org/wiki/Monero"},{"credibility":1,"name":"Bloomberg: Darknet Demand for Monero Rises","type":"news_article","url":"https://www.bloomberg.com/news/articles/2026-02-13/darknet-demand-for-monero-xmr-rises-stumping-crime-fighters"},{"credibility":2,"name":"CoinDesk: $330M Hack Monero Laundering","type":"news_article","url":"https://www.coindesk.com/business/2025/04/29/did-the-usd330m-btc-hacker-deliberatley-pump-monero-to-make-even-more-money"},{"credibility":2,"name":"CoinDesk: Binance to Delist Monero","type":"news_article","url":"https://www.coindesk.com/markets/2024/02/06/binance-to-delist-monero-privacy-token-xmr-slides"},{"credibility":2,"name":"TRM Labs: Archetyp Market Takedown","type":"research","url":"https://www.trmlabs.com/resources/blog/europol-leads-international-takedown-of-longest-running-darknet-market-archetyp"},{"credibility":2,"name":"Chainalysis: OFAC Nemesis Designation","type":"research","url":"https://www.chainalysis.com/blog/ofac-designation-iran-darknet-markets-bitcoin-fentanyl-march-2025/"},{"credibility":2,"name":"The Defiant: EU AML Privacy Coin Ban","type":"news_article","url":"https://thedefiant.io/news/regulation/eu-aml-rules-to-ban-anonymous-accounts-privacy-coins"},{"credibility":2,"name":"Decrypt: IRS Monero Bounties","type":"news_article","url":"https://decrypt.co/43451/irs-1-million-contracts-data-firms-crack-monero"},{"credibility":2,"name":"BleepingComputer: Monero Binary Compromise","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/coin-stealer-found-in-monero-linux-binaries-from-official-site/"},{"credibility":2,"name":"Decrypt: Cryptojacking 3,500+ Sites","type":"news_article","url":"https://decrypt.co/331195/cryptojacking-resurfaces-as-monero-miner-malware-hits-3500-sites-report"},{"credibility":2,"name":"CoinMarketCap: Monero","type":"other","url":"https://coinmarketcap.com/currencies/monero/"}],"summary":"Monero (XMR) is a legitimate, open-source, community-funded privacy cryptocurrency launched in 2014 with no premine and a clean protocol-level security track record. However, it carries significant third-party risk: Archetyp Market ($267M, Monero-exclusive) was dismantled by DOJ/Europol in June 2025; $330M+ in stolen BTC was laundered via XMR in 2025; Binance, Kraken EEA, OKX, and 60+ exchanges have delisted it; and the EU AMLR bans CASP handling of privacy coins by July 2027. Former lead maintainer Riccardo Spagni faces 378 fraud/forgery charges in South Africa (pre-dating Monero).","timeline":[{"date":"2014-04-18","event":"Monero launched as fork of Bytecoin","source":"wikipedia.org","source_url":"https://en.wikipedia.org/wiki/Monero"},{"date":"2019-11-19","event":"Official Monero website binary compromised with coin-stealing malware","source":"bleepingcomputer.com","source_url":"https://www.bleepingcomputer.com/news/security/coin-stealer-found-in-monero-linux-binaries-from-official-site/"},{"date":"2020-09-01","event":"IRS offers $1.25M in bounties for Monero tracing tools","source":"decrypt.co","source_url":"https://decrypt.co/43451/irs-1-million-contracts-data-firms-crack-monero"},{"date":"2021-08-02","event":"Riccardo Spagni (fluffypony) arrested in the U.S.","source":"coindesk.com","source_url":"https://www.coindesk.com/markets/2021/08/02/former-monero-maintainer-fluffypony-arrested-and-to-be-extradited-for-non-crypto-crimes"},{"date":"2022-06-02","event":"Spagni extradited to South Africa","source":"news24.com","source_url":"https://www.news24.com/business/companies/crypto-developer-fluffypony-to-be-extradited-to-sa-to-face-r14-million-fraud-charge-20220602"},{"date":"2024-02-06","event":"Binance delists Monero","source":"coindesk.com","source_url":"https://www.coindesk.com/markets/2024/02/06/binance-to-delist-monero-privacy-token-xmr-slides"},{"date":"2024-10-01","event":"Kraken delists Monero in the EEA","source":"cryptobriefing.com","source_url":"https://cryptobriefing.com/kraken-monero-delisting-eea/"},{"date":"2025-01-01","event":"$282M theft laundered via XMR","source":"coindesk.com","source_url":"https://www.coindesk.com/markets/2025/04/28/monero-price-surge-likely-attributable-to-large-hack-zachxbt"},{"date":"2025-03-01","event":"OFAC sanctions Nemesis Market Monero addresses","source":"theblock.co","source_url":"https://www.theblock.co/post/344583/ofac-sanctions-bitcoin-monero-addresses-darknet-nemesis"},{"date":"2025-04-28","event":"$330M BTC theft laundered via XMR swap (ZachXBT)","source":"coindesk.com","source_url":"https://www.coindesk.com/business/2025/04/29/did-the-usd330m-btc-hacker-deliberatley-pump-monero-to-make-even-more-money"},{"date":"2025-06-15","event":"Archetyp Market ($267M, Monero-exclusive) dismantled by DOJ/Europol","source":"trmlabs.com","source_url":"https://www.trmlabs.com/resources/blog/europol-leads-international-takedown-of-longest-running-darknet-market-archetyp"},{"date":"2026-01-01","event":"Monero reaches all-time high of $799.89","source":"coinmarketcap.com","source_url":"https://coinmarketcap.com/currencies/monero/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 112522bd-0062-479d-b61d-f298f8cecbe8copy
2. #2reviewby reviewerreviewer

   2026-06-14 23:16:09Z
   Score: 42 → 42 (no score change)
   Blue-chip calibration review (Prompt A). Verdict: over-penalized. Page content is treated as accurate; the trust_score band is miscalibrated. Monero is a legitimate, open-source privacy cryptocurrency that launched in April 2014 with no premine and is legal to own in both the US and EU as of 2026. Every incident driving its WARNING/42 score is attributable to third-party abuse of its privacy features (darknet drug markets, money laundering by independent thieves, cryptojacking by unrelated malicious actors) or to regulatory pressure that constrains exchange listings but does not constitute a fraud finding against the project itself. The page's own summary explicitly acknowledges Monero's legitimacy yet scores it identically to high-risk scam/fraud entities. Under the stated band semantics — WARNING (20-49) is reserved for entities with elevated fraud/loss risk or unresolved severe incident caused by the entity — Monero does not qualify: it has never been found to have committed fraud, misappropriated user funds, or operated deceptively. The appropriate band is CAUTIONARY (50-69), reflecting the real material caveats: widespread exchange delistings, imminent EU AMLR prohibition on regulated-entity handling, documented heavy use in money laundering and dark markets, and the former lead maintainer's unresolved personal criminal charges. A score of 58 captures these legitimate concerns while correctly distinguishing a protocol that is a victim of its own privacy properties from one that is itself fraudulent or negligent.
   anchoranchored

   chain

   ●mainnet-betaslot 426,514,694

   sig

   4KPA3EtYm1nm…8YC7XU1Dcopyexplorer ↗

   hash

   J3zTau3ec16r…RKNcyjSscopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1884 B) ▸

   {"actor":"reviewer","decided_at":"2026-06-14T23:16:09.401Z","decision":"review","investigation_id":"ab69b864-4fd5-4abf-8bcb-9c6f65db0c25","new_score":42,"page_slug":"monero","prev_score":42,"reason":"Blue-chip calibration review (Prompt A). Verdict: over-penalized. Page content is treated as accurate; the trust_score band is miscalibrated. Monero is a legitimate, open-source privacy cryptocurrency that launched in April 2014 with no premine and is legal to own in both the US and EU as of 2026. Every incident driving its WARNING/42 score is attributable to third-party abuse of its privacy features (darknet drug markets, money laundering by independent thieves, cryptojacking by unrelated malicious actors) or to regulatory pressure that constrains exchange listings but does not constitute a fraud finding against the project itself. The page's own summary explicitly acknowledges Monero's legitimacy yet scores it identically to high-risk scam/fraud entities. Under the stated band semantics — WARNING (20-49) is reserved for entities with elevated fraud/loss risk or unresolved severe incident caused by the entity — Monero does not qualify: it has never been found to have committed fraud, misappropriated user funds, or operated deceptively. The appropriate band is CAUTIONARY (50-69), reflecting the real material caveats: widespread exchange delistings, imminent EU AMLR prohibition on regulated-entity handling, documented heavy use in money laundering and dark markets, and the former lead maintainer's unresolved personal criminal charges. A score of 58 captures these legitimate concerns while correctly distinguishing a protocol that is a victim of its own privacy properties from one that is itself fraudulent or negligent.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 054bce58-8f61-4bac-83be-e1b1fb41825fcopy
3. #3review approveby judgejudge

   2026-06-14 23:16:09Z
   Score: 42 → 58 (+16)
   The blue-chip calibration review returned zero disputed claims across all six claim_findings (disputed_pct = 0%). Every incident driving the current WARNING/42 score — darknet market payments (claim_findings[1]), money laundering events (claim_findings[1]), and cryptojacking campaigns (modifier_flags[2]) — is attributable to third-party abuse of Monero's privacy features, not to fraud, deception, or fund misappropriation by the Monero project itself. As claim_findings[5] notes, the page's own summary already acknowledges Monero is 'legitimate, open-source' with 'no premine,' making its WARNING band placement internally inconsistent with stated band semantics. The former lead maintainer's legal charges (claim_findings[4]) pre-date Monero and are unrelated to the protocol. Real, material caveats remain — widespread exchange delistings, EU AMLR prohibition incoming by July 2027, and the Spagni charges — which a CAUTIONARY/58 score appropriately captures. Applying a +16 score_modifier_delta to move from 42 to the reviewer's recommended 58 is warranted. The page content is accurate and must remain published.
   anchoranchored

   chain

   ●mainnet-betaslot 426,514,698

   sig

   45L7u34P7WUE…XyQkTuomcopyexplorer ↗

   hash

   3dX4bdLc1WXt…EbSTqqzRcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1468 B) ▸

   {"actor":"judge","decided_at":"2026-06-14T23:16:09.401Z","decision":"review_approve","investigation_id":"ab69b864-4fd5-4abf-8bcb-9c6f65db0c25","new_score":58,"page_slug":"monero","prev_score":42,"reason":"The blue-chip calibration review returned zero disputed claims across all six claim_findings (disputed_pct = 0%). Every incident driving the current WARNING/42 score — darknet market payments (claim_findings[1]), money laundering events (claim_findings[1]), and cryptojacking campaigns (modifier_flags[2]) — is attributable to third-party abuse of Monero's privacy features, not to fraud, deception, or fund misappropriation by the Monero project itself. As claim_findings[5] notes, the page's own summary already acknowledges Monero is 'legitimate, open-source' with 'no premine,' making its WARNING band placement internally inconsistent with stated band semantics. The former lead maintainer's legal charges (claim_findings[4]) pre-date Monero and are unrelated to the protocol. Real, material caveats remain — widespread exchange delistings, EU AMLR prohibition incoming by July 2027, and the Spagni charges — which a CAUTIONARY/58 score appropriately captures. Applying a +16 score_modifier_delta to move from 42 to the reviewer's recommended 58 is warranted. The page content is accurate and must remain published.","score_delta":16,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision a62f4463-9f8d-4677-aa0c-c2471f970105copy