Audit log

Every state-changing event for Normie (NORMIE): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-07-25 23:29:27Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   8VtQry4WndgU…QKtT2iYJcopysha256 → base58

   verifying row…

   canonical bytes (18829 B) ▸

   {"actor":"system:backfill","investigation_id":"d6ad5404-4aa1-48db-89cb-cf782cf77ca8","kind":"publish","page_slug":"normie-memecoin","published_at":"2026-07-25T23:29:27.663Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Normie (NORMIE)","sections":[{"content":"On May 26, 2024, an unidentified attacker executed a flash loan exploit against the NORMIE token contract (0x7F12d13B34F5F4f0a9449c16Bcd42f0da47AF200) deployed on the Base blockchain. According to CertiK's incident analysis, the attack exploited a premarket-user recognition flaw: any address receiving a quantity of tokens equal to the deployer's balance was automatically added to a privileged _premarket_user list that triggered additional token minting. The attacker purchased 5 million NORMIE tokens to obtain this privileged status, then flash-loaned 11,333,141 NORMIE tokens and repeatedly transferred them to the trading pair contract, calling skim() to extract value. Because the attack contract was recognized as a premarket_user, the token contract minted tokens to itself, accumulating over 650 billion tokens despite the nominal 1 billion supply cap. The swapAndLiquify mechanism automatically sold the newly minted tokens into the liquidity pool, draining it. The attacker ultimately extracted 224.98 ETH (approximately $881,686 at the time). The market cap collapsed from approximately $41 million to approximately $35,000 within hours. The exploiter wallet address is 0xf7f3a556Ac21d081F6dBa961B6A84E52e37A717D. An example exploit transaction hash is 0xa618933a0e0ffd0b9f4f0835cc94e523d0941032821692c01aa96cd6f80fc3fd.","heading":"Smart Contract Exploit — May 26, 2024","severity":"critical","sources":[{"credibility":2,"name":"Normie Incident Analysis — CertiK","type":"research","url":"https://www.certik.com/resources/blog/normie-incident-analysis"},{"credibility":2,"name":"Block Forensics: An In-Depth Analysis of the Normie Memecoin Incident — Extropy.IO / Medium","type":"research","url":"https://extropy-io.medium.com/block-forensics-an-in-depth-analysis-of-the-normie-memecoin-incident-0daf5baed08b"},{"credibility":2,"name":"Base Memecoin Normie Loses $40 Million in Market Cap After Exploit — Unchained Crypto","type":"news_article","url":"https://unchainedcrypto.com/base-memecoin-normie-loses-40-million-in-market-cap-after-exploit/"}]},{"content":"Blockchain scam-detection tool Quick Intel alleged that the smart contract vulnerability exploited on May 26, 2024 had been detected as early as March 2024 — approximately two months before the attack. According to reporting by Web3 Is Going Great and Invezz, the vulnerability was evidently discovered in March but never patched. The development team did not publicly acknowledge or remediate the flaw during this window. The attacker's own on-chain message characterized the contract code as a 'copy-paste job,' stating: 'This exact code is present in a number of other token contracts, a few of which significantly pre-date Normie.' CoinDesk reported the attacker elaborated that 'most meme tokens are simply copy-paste jobs from the same small set of contracts, all with over-complicated tax logic in the transfer function.' CertiK's post-mortem attributed the vulnerability to forking code without proper security auditing, thereby inheriting unresolved vulnerabilities from upstream contracts. Unchained Crypto noted that an analyst assessed it was 'almost certain it's someone involved with the team or whoever wrote the contract' unless the code was forked from another project, though no insider involvement was proven.","heading":"Known Vulnerability — Unpatched Since March 2024","severity":"critical","sources":[{"credibility":2,"name":"'Normie' memecoin plummets 99% after exploit — Web3 Is Going Great","type":"news_article","url":"https://www.web3isgoinggreat.com/?id=normie-exploit"},{"credibility":2,"name":"Normie Dumps 99% as Attacker Calls Meme Coin's Tax Contract a 'Copy-Paste' Job — CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2024/05/27/normie-dumps-99-as-attacker-calls-meme-coins-tax-contract-a-copy-paste-job"},{"credibility":2,"name":"Memecoin Normie Coin (NORMIE) down 99% following a flash loan attack — Invezz","type":"news_article","url":"https://invezz.com/news/2024/05/27/memecoin-normie-coin-normie-down-99-following-a-flash-loan-attack/"},{"credibility":2,"name":"Normie Incident Analysis — CertiK","type":"research","url":"https://www.certik.com/resources/blog/normie-incident-analysis"}]},{"content":"Approximately 72,000 NORMIE holders were affected by the exploit, according to Quick Intel as reported by multiple outlets. The most documented individual loss involved one on-chain trader who had accumulated 11.23 million NORMIE tokens between March 25 and April 9, 2024, spending approximately $1.16 million at an average price of $0.1035. Following the exploit, that position was valued at less than $150 — a loss exceeding 99.99%. CoinGape reported the position fell to under $150; DailyCoin and CoinTelegraph corroborated the scale of the loss. The total market cap destruction was approximately $41 million, with the token collapsing from a peak of approximately $130 million on April 2 to near zero on May 26.","heading":"Investor Losses and Affected Holders","severity":"critical","sources":[{"credibility":2,"name":"Meme coin NORMIE Exploit Turns $1.1 Million Investment to Less Than $150 — CoinGape","type":"news_article","url":"https://coingape.com/meme-coin-normie-exploit-turns-1-1-million-investment-to-less-than-150/"},{"credibility":2,"name":"Meme Coin Hacked: Major Investor Loses Big as ETH Exploit Wipes Out Millions in NORMIE Value — DailyCoin","type":"news_article","url":"https://dailycoin.com/eth-exploit-sends-normie-down-98-hacker-to-return-funds/"},{"credibility":2,"name":"Memecoin trader loses over $1M following Normie exploit — TradingView / CoinTelegraph","type":"news_article","url":"https://www.tradingview.com/news/cointelegraph:c83190e40094b:0-memecoin-trader-loses-over-1m-following-normie-exploit/"}]},{"content":"Following the exploit, the attacker posted an on-chain message offering to return 90% of the extracted ETH under specific conditions: the development team would use the returned funds combined with 600 ETH from the developer wallet to fairly relaunch a new token to reimburse affected NORMIE holders. The attacker explicitly demanded 'no reprisals.' The Normie development team accepted these terms by early Monday, May 27, 2024, as reported by CoinDesk and confirmed via messages in the project's official Telegram group. The attacker retained approximately 22.5 ETH (10% of the total extracted) as a self-designated 'bug bounty.' The agreement to negotiate with — and grant immunity to — the attacker, rather than pursuing legal remedies, is notable. The team's official X (formerly Twitter) account was subsequently suspended following the exploit. No regulatory action or law enforcement referral has been publicly reported.","heading":"Attacker Negotiations and 'No Reprisals' Agreement","severity":"high","sources":[{"credibility":2,"name":"Normie memecoin team mulls hacker demands after token falls 99% — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/normie-memecoin-team-mulls-hacker-demands-after-token-falls-99"},{"credibility":2,"name":"Normie Team Negotiates 90% Fund Return After $41.7M Market Cap Plunge — CryptoNews","type":"news_article","url":"https://cryptonews.com/news/normie-team-negotiates-90-fund-return-after-41-7m-market-cap-plunge/"},{"credibility":2,"name":"Normie Dumps 99% as Attacker Calls Meme Coin's Tax Contract a 'Copy-Paste' Job — CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2024/05/27/normie-dumps-99-as-attacker-calls-meme-coins-tax-contract-a-copy-paste-job"}]},{"content":"Immediately following the announcement that the NORMIE team had accepted the attacker's relaunch offer, fraudulent actors on X (formerly Twitter) flooded the platform with fake posts falsely announcing the relaunch of a new Normie token. These posts were designed to direct users to malicious links, compounding harm to existing holders who were seeking legitimate recovery information. This secondary fraud wave occurred while the team's official X account was suspended, creating an information vacuum that scammers exploited. CryptoRank and CoinPaper documented this post-exploit fraud environment.","heading":"Post-Exploit Fraud and Scam Accounts","severity":"high","sources":[{"credibility":2,"name":"Normie Meme Coin Holders Left in Limbo After Major Exploit — CoinPaper","type":"news_article","url":"https://coinpaper.com/4298/normie-meme-coin-holders-left-in-limbo-after-major-exploit"},{"credibility":2,"name":"Normie Meme Coin Holders Left in Limbo After Major Exploit — CryptoRank","type":"news_article","url":"https://cryptorank.io/news/feed/b256d-normie-meme-coin-holders-left-in-limbo-after-major-exploit"}]},{"content":"On or around June 10, 2024, the Normie project's official X account posted a promotional video showing the Normie character hanging itself, being buried, and meeting a divine figure. The video sparked widespread condemnation across the crypto community, with users alleging the content depicted and potentially encouraged suicide. The project removed the video and issued an apology, stating the intended message was that 'there is always a way out, even when everything is coming at you' but acknowledging the execution 'unintentionally triggered a sensitive topic.' The team stated that 'the intern that posted it has been fired,' though community members questioned whether the intern firing was genuine or itself a meme-format deflection. Decrypt and CoinTelegraph covered the incident. This event occurred after the May 26 exploit and during the alleged relaunch period.","heading":"Offensive Marketing Content — June 2024","severity":"medium","sources":[{"credibility":2,"name":"Base Meme Coin Normie Removes Video Depicting Suicide, Following Backlash — Decrypt","type":"news_article","url":"https://decrypt.co/234588/base-meme-coin-normie-removes-suicide-video-backlash"},{"credibility":2,"name":"Base memecoin project Normie fires intern over offensive video — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/base-memecoin-project-normie-fires-intern"},{"credibility":2,"name":"Normie Memecoin Project Fires Intern Over Offensive Video — CryptoNews","type":"news_article","url":"https://cryptonews.com/news/normie-memecoin-project-fires-intern-over-offensive-video-apologizes-for-content/"}]},{"content":"NORMIE launched in March 2024 amid a memecoin surge on Coinbase's Base layer-2 blockchain. The token reached a peak market cap of approximately $130 million on April 2, 2024. The development team's identities were not publicly disclosed, operating under a pseudonymous structure typical of memecoin projects. The token's smart contract incorporated a tax mechanism — a common feature in memecoin contracts designed to fund project treasuries — but this implementation contained the critical flaw later exploited. The team held a substantial developer wallet estimated at 600 ETH ($2.3 million equivalent) at the time of the exploit. No independent security audit of the NORMIE contract by a recognized firm was publicly disclosed prior to the May 2024 exploit.","heading":"Project Background and Token Characteristics","severity":"high","sources":[{"credibility":2,"name":"Base Memecoin Normie Loses $40 Million in Market Cap After Exploit — Unchained Crypto","type":"news_article","url":"https://unchainedcrypto.com/base-memecoin-normie-loses-40-million-in-market-cap-after-exploit/"},{"credibility":2,"name":"NORMIE Crashes 99.8% in Minutes After Devastating Attack — CryptoRank","type":"news_article","url":"https://cryptorank.io/news/feed/8db53-normie-memecoin-crashes-99-8-in-minutes"}]}],"sources_used":[{"credibility":2,"name":"Normie Incident Analysis — CertiK","type":"research","url":"https://www.certik.com/resources/blog/normie-incident-analysis"},{"credibility":2,"name":"Block Forensics: An In-Depth Analysis of the Normie Memecoin Incident — Extropy.IO / Medium","type":"research","url":"https://extropy-io.medium.com/block-forensics-an-in-depth-analysis-of-the-normie-memecoin-incident-0daf5baed08b"},{"credibility":2,"name":"Normie Dumps 99% as Attacker Calls Meme Coin's Tax Contract a 'Copy-Paste' Job — CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2024/05/27/normie-dumps-99-as-attacker-calls-meme-coins-tax-contract-a-copy-paste-job"},{"credibility":2,"name":"Base Memecoin Normie Loses $40 Million in Market Cap After Exploit — Unchained Crypto","type":"news_article","url":"https://unchainedcrypto.com/base-memecoin-normie-loses-40-million-in-market-cap-after-exploit/"},{"credibility":2,"name":"'Normie' memecoin plummets 99% after exploit — Web3 Is Going Great","type":"news_article","url":"https://www.web3isgoinggreat.com/?id=normie-exploit"},{"credibility":2,"name":"Normie memecoin team mulls hacker demands after token falls 99% — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/normie-memecoin-team-mulls-hacker-demands-after-token-falls-99"},{"credibility":2,"name":"Meme coin NORMIE Exploit Turns $1.1 Million Investment to Less Than $150 — CoinGape","type":"news_article","url":"https://coingape.com/meme-coin-normie-exploit-turns-1-1-million-investment-to-less-than-150/"},{"credibility":2,"name":"Normie Team Negotiates 90% Fund Return After $41.7M Market Cap Plunge — CryptoNews","type":"news_article","url":"https://cryptonews.com/news/normie-team-negotiates-90-fund-return-after-41-7m-market-cap-plunge/"},{"credibility":2,"name":"Meme Coin Hacked: Major Investor Loses Big as ETH Exploit Wipes Out Millions in NORMIE Value — DailyCoin","type":"news_article","url":"https://dailycoin.com/eth-exploit-sends-normie-down-98-hacker-to-return-funds/"},{"credibility":2,"name":"Base Meme Coin Normie Removes Video Depicting Suicide, Following Backlash — Decrypt","type":"news_article","url":"https://decrypt.co/234588/base-meme-coin-normie-removes-suicide-video-backlash"},{"credibility":2,"name":"Base memecoin project Normie fires intern over offensive video — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/base-memecoin-project-normie-fires-intern"},{"credibility":2,"name":"Normie Meme Coin Holders Left in Limbo After Major Exploit — CoinPaper","type":"news_article","url":"https://coinpaper.com/4298/normie-meme-coin-holders-left-in-limbo-after-major-exploit"},{"credibility":2,"name":"Memecoin Normie Coin (NORMIE) down 99% following a flash loan attack — Invezz","type":"news_article","url":"https://invezz.com/news/2024/05/27/memecoin-normie-coin-normie-down-99-following-a-flash-loan-attack/"},{"credibility":2,"name":"Normie Token Plummets 99% After Smart Contract Exploit — CryptoPotato","type":"news_article","url":"https://cryptopotato.com/normie-token-plummets-99-after-smart-contract-exploit/"},{"credibility":2,"name":"Normie Memecoin Crash 99% Following Platform Exploit, Team Agrees to Relaunch — DeFi Planet","type":"news_article","url":"https://defi-planet.com/2024/05/normie-memecoin-crash-99-following-platform-exploit-team-agrees-to-relaunch/"}],"summary":"Normie (NORMIE) was a memecoin launched in March 2024 on Coinbase's Base layer-2 blockchain that reached a peak market cap of approximately $130 million on April 2, 2024. On May 26, 2024, an attacker exploited a premarket-user recognition flaw in the token's smart contract via a flash loan attack, minting billions of tokens beyond the 1 billion supply cap and draining liquidity pools, causing a 99% price collapse and approximately $41 million in market cap destruction. A blockchain scam-detection tool reported the vulnerability had been detected in March 2024 but was never patched by the development team.","timeline":[{"date":"2024-03-01","event":"NORMIE token launched on the Base blockchain. Exact launch date within March 2024 not precisely confirmed in available sources.","source":"Unchained Crypto","source_url":"https://unchainedcrypto.com/base-memecoin-normie-loses-40-million-in-market-cap-after-exploit/"},{"date":"2024-03-01","event":"Smart contract vulnerability allegedly detected by blockchain scam-detection tool Quick Intel. The vulnerability was not publicly disclosed or patched at this time.","source":"Web3 Is Going Great / Invezz","source_url":"https://www.web3isgoinggreat.com/?id=normie-exploit"},{"date":"2024-04-02","event":"NORMIE reaches peak market cap of approximately $130 million.","source":"Unchained Crypto","source_url":"https://unchainedcrypto.com/base-memecoin-normie-loses-40-million-in-market-cap-after-exploit/"},{"date":"2024-05-26","event":"Flash loan exploit executed on the NORMIE smart contract on Base blockchain. Attacker extracts approximately 224.98 ETH (~$881,686). Token price collapses 99%+. Market cap falls from ~$41 million to ~$35,000. Approximately 72,000 holders affected.","source":"CertiK Incident Analysis","source_url":"https://www.certik.com/resources/blog/normie-incident-analysis"},{"date":"2024-05-26","event":"Attacker posts on-chain message offering to return 90% of exploited ETH ('keeping 10% as a bug bounty') in exchange for no reprisals and a project relaunch using returned funds plus 600 ETH from the developer wallet.","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2024/05/27/normie-dumps-99-as-attacker-calls-meme-coins-tax-contract-a-copy-paste-job"},{"date":"2024-05-26","event":"One whale investor's position of 11.23 million NORMIE tokens — purchased for approximately $1.16 million between March 25 and April 9 — falls to a value of less than $150.","source":"CoinGape","source_url":"https://coingape.com/meme-coin-normie-exploit-turns-1-1-million-investment-to-less-than-150/"},{"date":"2024-05-27","event":"Normie development team accepts the attacker's 90% return offer with 'no reprisals.' The team commits to relaunching a new token to compensate holders using recovered and developer funds. The team's official X account is suspended. Fraudulent scam posts promoting fake relaunch links flood social media.","source":"CoinTelegraph / CryptoNews","source_url":"https://cointelegraph.com/news/normie-memecoin-team-mulls-hacker-demands-after-token-falls-99"},{"date":"2024-06-10","event":"Normie project posts a promotional video on X depicting the Normie character in a hanging scenario. Community backlash is immediate. The project removes the video, issues an apology, and claims an intern was fired. The authenticity of the firing is disputed.","source":"Decrypt / CoinTelegraph","source_url":"https://decrypt.co/234588/base-meme-coin-normie-removes-suicide-video-backlash"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 9ab0440a-3d92-4002-b27a-d3a2b4f283e9copy