Audit log

Every state-changing event for MoonHacker: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-30 04:47:49Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 423,086,605

   sig

   2AM56yu3kkuA…tA3JRCS5copyexplorer ↗

   hash

   B8VmanFxXULb…XMdaboPacopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (4478 B) ▸

   {"actor":"system:backfill","investigation_id":"0b5775ae-4d7b-40c9-b388-53a4f8c826e1","kind":"publish","page_slug":"moonhacker","published_at":"2026-05-30T04:47:49.855Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"MoonHacker","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blog.solidityscan.com/moonhacker-vault-hack-analysis-ab122cb226f6","type":"other","url":""},{"credibility":3,"name":"https://blog.verichains.io/p/moonhacker-vault-hack-analysis","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blog.solidityscan.com/moonhacker-vault-hack-analysis-ab122cb226f6","type":"other","url":""},{"credibility":3,"name":"https://blog.verichains.io/p/moonhacker-vault-hack-analysis","type":"other","url":""},{"credibility":3,"name":"https://x.com/dedaub/status/1874838342485102852","type":"other","url":""},{"credibility":3,"name":"https://coinedition.com/moonwell-defi-hit-by-320k-flash-loan-exploit-security-risks-highlighted/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blog.verichains.io/p/moonhacker-vault-hack-analysis","type":"other","url":""},{"credibility":3,"name":"https://blog.solidityscan.com/moonhacker-vault-hack-analysis-ab122cb226f6","type":"other","url":""},{"credibility":3,"name":"https://www.chaincatcher.com/en/article/2158930","type":"other","url":""},{"credibility":3,"name":"https://bitcoinethereumnews.com/tech/moonwell-defi-exploited-in-320k-flash-loan-attack/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://x.com/dedaub/status/1874838342485102852","type":"other","url":""},{"credibility":3,"name":"https://blog.solidityscan.com/moonhacker-vault-hack-analysis-ab122cb226f6","type":"other","url":""},{"credibility":3,"name":"https://blog.verichains.io/p/moonhacker-vault-hack-analysis","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blog.solidityscan.com/moonhacker-vault-hack-analysis-ab122cb226f6","type":"other","url":""},{"credibility":3,"name":"https://coinedition.com/moonwell-defi-hit-by-320k-flash-loan-exploit-security-risks-highlighted/","type":"other","url":""},{"credibility":3,"name":"https://bitcoinethereumnews.com/tech/moonwell-defi-exploited-in-320k-flash-loan-attack/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://newsletter.blockthreat.io/p/blockthreat-week-52-2024","type":"other","url":""},{"credibility":3,"name":"https://www.chaincatcher.com/en/article/2158930","type":"other","url":""},{"credibility":3,"name":"https://blog.solidityscan.com/moonhacker-vault-hack-analysis-ab122cb226f6","type":"other","url":""}]}],"sources_used":[],"summary":"MoonHacker is an independently deployed DeFi vault protocol built on Optimism that was designed to interact with the Moonwell lending protocol. On December 23, 2024, MoonHacker vault contracts suffered a flash loan exploit due to improper input validation and absent access controls in the executeOperation function, resulting in the loss of approximately $320,000 USDC. The Moonwell team confirmed no affiliation with MoonHacker, the vault deployers remain anonymous, and stolen funds were converted to DAI and routed through Tornado Cash, complicating recovery efforts.","timeline":[{"date":"2024-12-23","event":"MoonHacker vault contracts exploited on Optimism via flash loan and unchecked executeOperation callback; approximately $320,000 USDC drained.","source":""},{"date":"2024-12-23","event":"Cyvers Alerts issues real-time alert identifying the attack on Moonwell's USDC lending contract on Optimism involving MoonHacker vault contracts.","source":""},{"date":"2024-12-23","event":"Stolen USDC swapped to DAI and retained in attacker wallet; attacker wallet had been pre-funded via Tornado Cash on Ethereum.","source":""},{"date":"2024-12-24","event":"Moonwell DeFi publicly disavows any affiliation with MoonHacker, confirming core Moonwell lending pools are unaffected.","source":""},{"date":"2025-01-02","event":"Dedaub discloses on X that its monitoring tools had flagged the unchecked flashloan callback and unrestricted approve proxy vulnerabilities in MoonHacker with high confidence prior to the exploit.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 3397555a-db16-4640-8b87-756e5fe6e09acopy
2. #2rescoreby systemsystem

   2026-10-10 18:39:29Z
   Score: 18 → 48 (+30)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 18 → 48. Problems weighed by who is responsible: concerns that are not fraud −9.6, incidents the subject suffered −6.4, problems around the subject, caused by others −0.8.
   anchoranchored

   chain

   ●mainnet-betaslot 455,357,321

   sig

   3v61tK3mhZ5E…2CweKGbKcopyexplorer ↗

   hash

   3FJdtDdF7BEZ…stPGX2QWcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (606 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:39:29.782Z","decision":"rescore","investigation_id":"0b5775ae-4d7b-40c9-b388-53a4f8c826e1","new_score":48,"page_slug":"moonhacker","prev_score":18,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 18 → 48. Problems weighed by who is responsible: concerns that are not fraud −9.6, incidents the subject suffered −6.4, problems around the subject, caused by others −0.8.","score_delta":30,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision b34e8e84-6b26-4f09-8cad-882d0f2e166dcopy
3. #3reviewby reviewerreviewer

   2026-11-03 23:22:32Z
   Score: 48 → 48 (no score change)
   Core facts (date, ~$320K USDC loss, executeOperation validation flaw, addresses, Moonwell non-affiliation) hold up. The summary wrongly says stolen funds were routed through Tornado Cash; sources say only the attacker's funding came from it. The Dedaub, ZachXBT and deployer-contact claims could not be verified, and the timeline entries carry no sources. I did not fetch SolidityScan, ChainCatcher or BlockThreat in full.
   anchoranchored

   chain

   ●mainnet-betaslot 465,082,240

   sig

   2C52hEY4BVnY…9NbUYjvLcopyexplorer ↗

   hash

   GGW61RJX4SYq…Wyg3yCn3copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1269 B) ▸

   {"actor":"reviewer","artifact_identity":"4de737a2c534224724ae7f61ff167ccf","blocked_count":1,"decided_at":"2026-11-03T23:22:32.845Z","decision":"review","disputed_pct":0.4444,"findings_hash":"AXV54j7h6hZWNvJHt36By89McM1d7Ba4v6ZzR8uxQvSr","investigation_id":"0b5775ae-4d7b-40c9-b388-53a4f8c826e1","judge_def_hash":"750934ecb48272224909b7430fab271676d391380fbc821acbe7ee7e4cac2fa3","new_score":48,"page_content_hash":"fe6adcd95ca5248f932d068a3682a390ecc1806bea6b30be320fad2a5b79a689","page_slug":"moonhacker","prev_score":48,"reason":"Core facts (date, ~$320K USDC loss, executeOperation validation flaw, addresses, Moonwell non-affiliation) hold up. The summary wrongly says stolen funds were routed through Tornado Cash; sources say only the attacker's funding came from it. The Dedaub, ZachXBT and deployer-contact claims could not be verified, and the timeline entries carry no sources. I did not fetch SolidityScan, ChainCatcher or BlockThreat in full.","reviewer_def_hash":"3839668b232611e5b26db72079d64745f8e57e919b8a379e79b44ba4a52c845b","score_delta":0,"scored_claims":9,"sequence_num":3,"subject_status":"unknown","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision fdf17417-0b6e-47c0-8bf7-85dbc82a37fecopy
4. #4review reviseby judgejudge

   2026-11-03 23:22:33Z
   Score: 48 → 48 (no score change)
   Of 9 countable claim findings (one was excluded because its source blocked the reviewer), 4 were disputed or unverifiable, about 44%. claim_findings[1] is disputed: the summary says stolen funds were routed through Tornado Cash, but sources and the page's own body say Tornado Cash only pre-funded the attacker's wallet. claim_findings[3], [8] and [9] (the Moonwell disavowal date, the ZachXBT flag and the deployer contact) could not be verified. The core facts (date, ~$320K USDC loss, root cause, addresses) were confirmed, so the penalty sits at the lower end of the band.
   anchoranchored

   chain

   ●mainnet-betaslot 465,082,245

   sig

   4c3N16n4eZF6…nPudKTfxcopyexplorer ↗

   hash

   7C6owSaBspHK…28vKGGdRcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1256 B) ▸

   {"actor":"judge","artifact_identity":"4de737a2c534224724ae7f61ff167ccf","band_override":null,"blocked_count":1,"decided_at":"2026-11-03T23:22:32.845Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.4444,"investigation_id":"0b5775ae-4d7b-40c9-b388-53a4f8c826e1","judge_def_hash":"750934ecb48272224909b7430fab271676d391380fbc821acbe7ee7e4cac2fa3","new_score":48,"page_slug":"moonhacker","prev_score":48,"reason":"Of 9 countable claim findings (one was excluded because its source blocked the reviewer), 4 were disputed or unverifiable, about 44%. claim_findings[1] is disputed: the summary says stolen funds were routed through Tornado Cash, but sources and the page's own body say Tornado Cash only pre-funded the attacker's wallet. claim_findings[3], [8] and [9] (the Moonwell disavowal date, the ZachXBT flag and the deployer contact) could not be verified. The core facts (date, ~$320K USDC loss, root cause, addresses) were confirmed, so the penalty sits at the lower end of the band.","reviewer_def_hash":"3839668b232611e5b26db72079d64745f8e57e919b8a379e79b44ba4a52c845b","score_delta":0,"scored_claims":9,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 7683deef-de6f-4688-9a49-fd5ac7bee95dcopy
5. #5rescoreby systemsystem

   2026-11-03 23:22:34Z
   Score: 48 → 58 (+10)
   Recalculated after the fact-check of 2026-11-03. Rescored under Scoring v2, the published formula (avoid.net/scoring): 48 → 58. Problems weighed by who is responsible: incidents the subject suffered −3.2, concerns that are not fraud −3.2, problems around the subject, caused by others −0.8; 3 section(s) set aside until a failed fact-check is resolved.
   anchoranchored

   chain

   ●mainnet-betaslot 465,082,250

   sig

   3rzwqGMFS58u…gSQYwoqwcopyexplorer ↗

   hash

   8dP6GY22Doxy…Q82KGKyDcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (717 B) ▸

   {"actor":"system","decided_at":"2026-11-03T23:22:32.845Z","decision":"rescore","investigation_id":"0b5775ae-4d7b-40c9-b388-53a4f8c826e1","new_score":58,"page_slug":"moonhacker","prev_score":48,"reason":"Recalculated after the fact-check of 2026-11-03. Rescored under Scoring v2, the published formula (avoid.net/scoring): 48 → 58. Problems weighed by who is responsible: incidents the subject suffered −3.2, concerns that are not fraud −3.2, problems around the subject, caused by others −0.8; 3 section(s) set aside until a failed fact-check is resolved.","score_delta":10,"score_model":"v2","sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision b8e02997-3c43-4130-bfcf-fc5de6f1b80ecopy