Audit log

Every state-changing event for Nirvana V1: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-28 17:25:06Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,765,165

   sig

   38mWT7JrTT6o…fhVd5Ug4copyexplorer ↗

   hash

   R64maftzv6om…rGYD4q7kcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (10593 B) ▸

   {"actor":"system:backfill","investigation_id":"b67d85f9-332e-4956-842b-0fdd3e06d9e0","kind":"publish","page_slug":"nirvana-v1","published_at":"2026-05-28T17:25:06.048Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Nirvana V1","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/tech/2022/07/28/solana-defi-protocol-nirvana-drained-of-liquidity-after-flash-loan-exploit","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/solana-based-stablecoin-nirv-drops-85-following-3-5m-exploit","type":"other","url":""},{"credibility":3,"name":"https://ackee.xyz/blog/2022-solana-hacks-explained-nirvana/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.certik.com/resources/blog/1UBzEHHu35dJdJOGsuf85D-nirvana-finance-incident-analysis","type":"other","url":""},{"credibility":3,"name":"https://ackee.xyz/blog/2022-solana-hacks-explained-nirvana/","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/tech/2022/07/28/solana-defi-protocol-nirvana-drained-of-liquidity-after-flash-loan-exploit","type":"other","url":""},{"credibility":3,"name":"https://cryptoslate.com/solana-based-nirvana-loses-3-49m-to-flash-loan-exploit-tokens-tank-90/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cointelegraph.com/news/solana-based-stablecoin-nirv-drops-85-following-3-5m-exploit","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/tech/2022/07/28/solana-defi-protocol-nirvana-drained-of-liquidity-after-flash-loan-exploit","type":"other","url":""},{"credibility":3,"name":"https://cryptoslate.com/solana-based-nirvana-loses-3-49m-to-flash-loan-exploit-tokens-tank-90/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.justice.gov/usao-sdny/pr/former-security-engineer-sentenced-three-years-prison-hacking-two-decentralized","type":"other","url":""},{"credibility":3,"name":"https://www.justice.gov/usao-sdny/pr/former-security-engineer-international-technology-company-pleads-guilty-hacking-two","type":"other","url":""},{"credibility":3,"name":"https://www.theblock.co/post/267737/nirvana-finance-hacker-pleads-guilty-agrees-to-pay-restitution-to-victims","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/policy/2024/04/12/hacker-sentenced-to-3-years-in-prison-for-stealing-over-12m-from-crypto-exchanges","type":"other","url":""},{"credibility":3,"name":"https://www.trmlabs.com/resources/blog/funds-returned-to-defi-exchange-nirvana-in-first-ever-defi-hack-prosecution","type":"other","url":""},{"credibility":3,"name":"https://blockworks.co/news/nirvana-hacker-pleads-guilty","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.trmlabs.com/resources/blog/funds-returned-to-defi-exchange-nirvana-in-first-ever-defi-hack-prosecution","type":"other","url":""},{"credibility":3,"name":"https://defiteller.com/nirvana-finance-hack-recovery-and-investor-compensation","type":"other","url":""},{"credibility":3,"name":"https://www.globenewswire.com/news-release/2024/12/16/2997825/0/en/Nirvana-Relaunches-After-Recovery-A-New-Vision-for-DeFi.html","type":"other","url":""},{"credibility":3,"name":"https://medium.com/nirvanafinance/nirvana-finance-rising-from-the-ashes-f2780607f685","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.certik.com/resources/blog/1UBzEHHu35dJdJOGsuf85D-nirvana-finance-incident-analysis","type":"other","url":""},{"credibility":3,"name":"https://ackee.xyz/blog/2022-solana-hacks-explained-nirvana/","type":"other","url":""}]}],"sources_used":[{"credibility":1,"name":"DOJ SDNY — Former Security Engineer Sentenced To Three Years In Prison For Hacking Two Decentralized Cryptocurrency Exchanges","type":"regulatory","url":"https://www.justice.gov/usao-sdny/pr/former-security-engineer-sentenced-three-years-prison-hacking-two-decentralized"},{"credibility":1,"name":"DOJ SDNY — Former Security Engineer Pleads Guilty To Hacking Two Decentralized Cryptocurrency Exchanges","type":"regulatory","url":"https://www.justice.gov/usao-sdny/pr/former-security-engineer-international-technology-company-pleads-guilty-hacking-two"},{"credibility":2,"name":"CoinDesk — Solana DeFi Protocol Nirvana Drained of Liquidity After Flash Loan Exploit","type":"news_article","url":"https://www.coindesk.com/tech/2022/07/28/solana-defi-protocol-nirvana-drained-of-liquidity-after-flash-loan-exploit"},{"credibility":2,"name":"CoinDesk — Hacker Sentenced to 3 Years in Prison for Stealing Over $12M From Crypto Exchanges","type":"news_article","url":"https://www.coindesk.com/policy/2024/04/12/hacker-sentenced-to-3-years-in-prison-for-stealing-over-12m-from-crypto-exchanges"},{"credibility":2,"name":"CoinTelegraph — Solana-based stablecoin NIRV drops 85% following $3.5M exploit","type":"news_article","url":"https://cointelegraph.com/news/solana-based-stablecoin-nirv-drops-85-following-3-5m-exploit"},{"credibility":2,"name":"CryptoSlate — Solana-based Nirvana loses $3.5M to flash loan exploit; tokens tank 90%","type":"news_article","url":"https://cryptoslate.com/solana-based-nirvana-loses-3-49m-to-flash-loan-exploit-tokens-tank-90/"},{"credibility":2,"name":"CertiK — Nirvana Finance Incident Analysis","type":"research","url":"https://www.certik.com/resources/blog/1UBzEHHu35dJdJOGsuf85D-nirvana-finance-incident-analysis"},{"credibility":2,"name":"Ackee Blockchain — 2022 Solana Hacks Explained: Nirvana","type":"research","url":"https://ackee.xyz/blog/2022-solana-hacks-explained-nirvana/"},{"credibility":2,"name":"The Block — Nirvana Finance hacker pleads guilty, agrees to pay restitution to victims","type":"news_article","url":"https://www.theblock.co/post/267737/nirvana-finance-hacker-pleads-guilty-agrees-to-pay-restitution-to-victims"},{"credibility":2,"name":"The Block — Ex-security engineer gets three years for first-ever smart contract hacking conviction","type":"news_article","url":"https://www.theblock.co/post/288108/ex-security-engineer-gets-three-years-for-first-ever-smart-contract-hacking-conviction-stole-12-million-in-crypto"},{"credibility":2,"name":"Blockworks — Nirvana Finance hacker pleads guilty, forfeits $12.3M","type":"news_article","url":"https://blockworks.co/news/nirvana-hacker-pleads-guilty"},{"credibility":2,"name":"Blockworks — Nirvana hacker sentenced to 3 years after pleading guilty","type":"news_article","url":"https://blockworks.com/news/nirvana-finance-hacker-sentenced"},{"credibility":2,"name":"TRM Labs — Funds Returned to DeFi Exchange Nirvana in First Ever DeFi Hack Prosecution","type":"research","url":"https://www.trmlabs.com/resources/blog/funds-returned-to-defi-exchange-nirvana-in-first-ever-defi-hack-prosecution"},{"credibility":3,"name":"DeFiTeller — Nirvana Finance Hack Recovery: Investor Compensation and Legal Outcome","type":"news_article","url":"https://defiteller.com/nirvana-finance-hack-recovery-and-investor-compensation"},{"credibility":2,"name":"GlobeNewswire — Nirvana Relaunches After Recovery: A New Vision for DeFi","type":"official","url":"https://www.globenewswire.com/news-release/2024/12/16/2997825/0/en/Nirvana-Relaunches-After-Recovery-A-New-Vision-for-DeFi.html"},{"credibility":3,"name":"Medium — Nirvana Finance: Rising from the Ashes (V2 announcement)","type":"official","url":"https://medium.com/nirvanafinance/nirvana-finance-rising-from-the-ashes-f2780607f685"}],"summary":"Nirvana V1 was a Solana-based algorithmic stablecoin and yield protocol that operated twin tokens: ANA (an algorithmic metastable wealth token) and NIRV (a decentralized stablecoin). On July 28, 2022, the protocol was catastrophically exploited via a flash loan attack that drained approximately $3.5 million — representing nearly all protocol reserves — causing both tokens to collapse and forcing a permanent shutdown. The attacker, Shakeeb Ahmed, was later identified, arrested, and convicted in the first-ever U.S. criminal prosecution for hacking a smart contract, and was sentenced to three years in prison in April 2024.","timeline":[{"date":"2022-07-02","event":"Shakeeb Ahmed conducts first hack, exploiting Crema Finance (a separate Solana DEX) for approximately $9 million using fake pricing data to generate inflated fees via flash loans.","source":""},{"date":"2022-07-28","event":"Nirvana V1 flash loan exploit: Shakeeb Ahmed drains approximately $3.5–3.6 million from Nirvana Finance treasury using price manipulation on the ANA smart contract. Stolen funds bridged to Ethereum via Wormhole and converted to DAI.","source":""},{"date":"2022-07-28","event":"Nirvana Finance suspends trading. ANA token falls over 85%; NIRV stablecoin depegs to approximately $0.08. Protocol announces loss of all collateral via Telegram.","source":""},{"date":"2022-07-28","event":"Nirvana Finance offers attacker a white-hat bounty of up to $600,000 in exchange for return of funds. Attacker counter-demands $1.4 million. No agreement reached.","source":""},{"date":"2022-08-01","event":"Nirvana Finance shuts down permanently following loss of all treasury reserves.","source":""},{"date":"2023-07-11","event":"U.S. DOJ (SDNY) arrests Shakeeb Ahmed and charges him with wire fraud and money laundering related to both the Crema Finance and Nirvana Finance hacks. Case described as first-ever U.S. criminal prosecution for hacking a smart contract.","source":""},{"date":"2023-12-14","event":"Shakeeb Ahmed pleads guilty to one count of computer fraud before U.S. Magistrate Judge Ona T. Wang (SDNY). Agrees to forfeit $12.3 million and pay over $5 million in restitution.","source":""},{"date":"2024-04-12","event":"Shakeeb Ahmed sentenced to 3 years in federal prison plus 3 years supervised release. Ordered to forfeit $12.3 million and pay restitution of over $5 million. First-ever criminal conviction for hacking a smart contract.","source":""},{"date":"2024-06-04","event":"Approximately $2.6 million returned to Nirvana Finance following enforcement of forfeiture order, as confirmed by TRM Labs.","source":""},{"date":"2024-12-17","event":"Nirvana Finance V2 launches publicly. Team opens compensation claims for V1 hack victims based on pro-rata share of recovered $2.6 million. Protocol pledges 10% of V2 fees to V1 victims in perpetuity.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 7cd7167f-6946-4be5-9d77-bb0fb3fe0cd7copy
2. #2rescoreby systemsystem

   2026-10-10 18:42:22Z
   Score: 5 → 50 (+45)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 5 → 50. Problems weighed by who is responsible: incidents the subject suffered −9.6, concerns that are not fraud −3.2, problems around the subject, caused by others −1.6; legitimacy credit long-running +4; no longer operating, so capped at 50.
   anchoranchored

   chain

   ●mainnet-betaslot 455,361,967

   sig

   3mHVTR1FdccQ…SrHeZ3axcopyexplorer ↗

   hash

   GaYZU8jtMMNu…574EomDscopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (677 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:42:22.178Z","decision":"rescore","investigation_id":"b67d85f9-332e-4956-842b-0fdd3e06d9e0","new_score":50,"page_slug":"nirvana-v1","prev_score":5,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 5 → 50. Problems weighed by who is responsible: incidents the subject suffered −9.6, concerns that are not fraud −3.2, problems around the subject, caused by others −1.6; legitimacy credit long-running +4; no longer operating, so capped at 50.","score_delta":45,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 073c49e3-2598-474e-8e64-1cdaed04ee8ecopy
3. #3reviewby reviewerreviewer

   2026-11-02 03:40:19Z
   Score: 50 → 50 (no score change)
   The core narrative holds. It covers the July 28, 2022 flash-loan exploit of about $3.5M, the Wormhole and DAI laundering path, the December 2023 plea, the April 2024 three-year sentence and the roughly $2.6M recovery. I found no outright disputed claims. Weak points are the unsourced $600k bounty and $1.4M counter-demand, the 'TVL 62 cents' figure taken from a contradictory caption, and the V2 launch details, which rest on project press material I did not read. The July 2023 arrest may be overattributed to Nirvana. Several DOJ and other primary fetches failed, so some checks relied on search snippets.
   anchoranchored

   chain

   ●mainnet-betaslot 464,347,435

   sig

   4kx8jiXiVatu…Jzh81cNocopyexplorer ↗

   hash

   3Xha54wVMDBz…cVqAT5FEcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1458 B) ▸

   {"actor":"reviewer","artifact_identity":"35349b4c262bdc8f7271feffa31a4367","decided_at":"2026-11-02T03:40:19.070Z","decision":"review","disputed_pct":0.1818,"findings_hash":"CRufhYSne31r2eT5R4E7jcGyfuR6KRxqPqeqD1oQJPdm","investigation_id":"b67d85f9-332e-4956-842b-0fdd3e06d9e0","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":50,"omissions":{"material":0,"total":1},"page_content_hash":"947bfb093d362465784002df16190fdbf3769e01c6fa03597626405078b9ecab","page_slug":"nirvana-v1","prev_score":50,"reason":"The core narrative holds. It covers the July 28, 2022 flash-loan exploit of about $3.5M, the Wormhole and DAI laundering path, the December 2023 plea, the April 2024 three-year sentence and the roughly $2.6M recovery. I found no outright disputed claims. Weak points are the unsourced $600k bounty and $1.4M counter-demand, the 'TVL 62 cents' figure taken from a contradictory caption, and the V2 launch details, which rest on project press material I did not read. The July 2023 arrest may be overattributed to Nirvana. Several DOJ and other primary fetches failed, so some checks relied on search snippets.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":3,"subject_status":"shut_down","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 9407d4bd-880a-4559-8499-8caea0700c88copy
4. #4review reviseby judgejudge

   2026-11-02 03:40:19Z
   Score: 50 → 50 (no score change)
   None of the 11 claims were disputed, but 2 could not be verified (claim_findings[3], the $600,000 bounty and $1.4M counter-demand; claim_findings[9], the V2 launch dates and 10% fee pledge). That puts the unverified share at about 18%, which falls in the minor-issues band. The core account of the exploit, the plea, the sentence and the recovery was confirmed. Smaller problems are the 62-cent TVL figure taken from a caption that conflicts with the article body (claim_findings[1]) and a July 2023 arrest that may be tied to Nirvana too early (claim_findings[8]). The only omission is minor (V2's current status), and the page does not contradict the project's status, so the penalty is small.
   anchoranchored

   chain

   ●mainnet-betaslot 464,347,440

   sig

   3BrZzEwpfbmW…XH3sWyrccopyexplorer ↗

   hash

   3Xnvq2EuEGdv…icadhHnBcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1339 B) ▸

   {"actor":"judge","artifact_identity":"35349b4c262bdc8f7271feffa31a4367","band_override":null,"decided_at":"2026-11-02T03:40:19.070Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.1818,"investigation_id":"b67d85f9-332e-4956-842b-0fdd3e06d9e0","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":50,"page_slug":"nirvana-v1","prev_score":50,"reason":"None of the 11 claims were disputed, but 2 could not be verified (claim_findings[3], the $600,000 bounty and $1.4M counter-demand; claim_findings[9], the V2 launch dates and 10% fee pledge). That puts the unverified share at about 18%, which falls in the minor-issues band. The core account of the exploit, the plea, the sentence and the recovery was confirmed. Smaller problems are the 62-cent TVL figure taken from a caption that conflicts with the article body (claim_findings[1]) and a July 2023 arrest that may be tied to Nirvana too early (claim_findings[8]). The only omission is minor (V2's current status), and the page does not contradict the project's status, so the penalty is small.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 24b8e78e-20e0-4d53-b94d-a33a7acceb58copy