Audit log

Every state-changing event for numa.: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-29 17:23:49Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,983,115

   sig

   4yn582nxNWAy…dtn7iVsTcopyexplorer ↗

   hash

   DeNS5fHnn138…DQmv4WvCcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (5690 B) ▸

   {"actor":"system:backfill","investigation_id":"4e0807c8-b31e-45cb-8db3-3c303761446e","kind":"publish","page_slug":"numa","published_at":"2026-05-29T17:23:49.367Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"numa.","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://numa.money/","type":"other","url":""},{"credibility":3,"name":"https://numa-1.gitbook.io/numa-v3-white-paper/introduction/summary","type":"other","url":""},{"credibility":3,"name":"https://www.chainlinkecosystem.com/ecosystem/numamoney","type":"other","url":""},{"credibility":3,"name":"https://coinpaprika.com/coin/numa-numa/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://numa.money/blog/update-on-recent-security-incident-affecting-numa","type":"other","url":""},{"credibility":3,"name":"https://numa.money/blog/incident-update-and-moving-forward","type":"other","url":""},{"credibility":3,"name":"https://www.hypernative.io/blog/hypernative-detection-506k-exploit-of-numa-money-on-arbitrum","type":"other","url":""},{"credibility":3,"name":"https://olympixai.medium.com/dexodus-zora-numa-946k-lost-to-replays-access-bugs-and-locked-in-prices-40c37b78391c","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blog.verichains.io/p/numa-incident-analysis","type":"other","url":""},{"credibility":3,"name":"https://www.certik.com/blog/numa-incident-analysis","type":"other","url":""},{"credibility":3,"name":"https://nominis.io/insights/nominis-monthly-report-crypto-attacks-in-september-2025","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coingecko.com/en/coins/numa","type":"other","url":""},{"credibility":3,"name":"https://www.coinbase.com/price/numa","type":"other","url":""},{"credibility":3,"name":"https://www.hypernative.io/blog/hypernative-detection-506k-exploit-of-numa-money-on-arbitrum","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/price/numa/price-prediction/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://numa.money/blog/incident-update-and-moving-forward","type":"other","url":""},{"credibility":3,"name":"https://blog.verichains.io/p/numa-incident-analysis","type":"other","url":""},{"credibility":3,"name":"https://www.certik.com/blog/numa-incident-analysis","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.hypernative.io/blog/hypernative-detection-506k-exploit-of-numa-money-on-arbitrum","type":"other","url":""},{"credibility":3,"name":"https://blog.verichains.io/p/numa-incident-analysis","type":"other","url":""},{"credibility":3,"name":"https://www.certik.com/blog/numa-incident-analysis","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://numa.money/blog/update-on-recent-security-incident-affecting-numa","type":"other","url":""},{"credibility":3,"name":"https://numa.money/blog/incident-update-and-moving-forward","type":"other","url":""},{"credibility":3,"name":"https://numa.money/","type":"other","url":""}]}],"sources_used":[],"summary":"numa. (stylized with a period) is a non-custodial DeFi protocol on Arbitrum and Sonic that issues LST-backed synthetic assets (nuUSD, nuBTC, nuETH, nuGOLD) through a burn-and-mint tokenomics model. The protocol suffered two separate exploits in 2025 — a $506K price manipulation attack in April and a $313K collateral valuation exploit in August — resulting in cumulative losses exceeding $800K and a token price decline of approximately 99% from its peak. ZachXBT has flagged the entity in the context of trust intelligence monitoring.","timeline":[{"date":"2024-12-01","event":"numa. protocol launches on Arbitrum with LST-backed synthetics (nuUSD, nuBTC, nuETH, nuGOLD) and burn-and-mint tokenomics.","source":""},{"date":"2025-04-18","event":"First exploit: attacker uses flash loan to manipulate $NUMA internal price via sell-burn-lock mechanism, stealing approximately 292.96 rETH (~$506K). Hypernative detected the attack 7+ minutes prior to execution. Stolen funds bridged to Ethereum and laundered through Tornado Cash.","source":""},{"date":"2025-04-18","event":"Numa team discovers exploit approximately one hour after execution. Protocol pauses lending and liquidation functionality.","source":""},{"date":"2025-04-21","event":"$NUMA token hits all-time low of approximately $0.13, down roughly 60% from pre-exploit price.","source":""},{"date":"2025-04-21","event":"Team publishes compensation plan: ~35 rETH in vault rewards, $100K external contribution, and direct team/protocol funds to make 1.49M $NUMA owed to external users whole.","source":""},{"date":"2025-05-01","event":"Team announces Sonic blockchain launch planned for end of May 2025, with Sherlock audit review required before deployment. Arbitrum lending to reopen after Sonic launch.","source":""},{"date":"2025-08-10","event":"Second exploit: attacker flash-mints nuBTC to inflate synthValueInEth, collapsing cNuma collateral prices and triggering forced liquidations of five victim accounts on Sonic. Approximately $313K (74.3 ETH) stolen. Funds bridged to Ethereum and deposited into Tornado Cash.","source":""},{"date":"2025-08-01","event":"Olympix publishes analysis of the August exploit, categorizing it as a locked-in price manipulation vulnerability. CertiK and Verichains publish independent post-mortems.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision b4c2090c-048b-444f-82d4-db0f85eecefecopy
2. #2rescoreby systemsystem

   2026-10-27 06:07:02Z
   Score: 32 → 45 (+13)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 32 → 45. Problems weighed by who is responsible: incidents the subject suffered −9.6, concerns that are not fraud −9.6, problems around the subject, caused by others −0.8.
   anchoranchored

   chain

   ●mainnet-betaslot 461,966,094

   sig

   5MzUpeegmvh2…QuU8bkSwcopyexplorer ↗

   hash

   6GLowExxudeY…YAQAoLi7copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (600 B) ▸

   {"actor":"system","decided_at":"2026-10-27T06:07:02.726Z","decision":"rescore","investigation_id":"4e0807c8-b31e-45cb-8db3-3c303761446e","new_score":45,"page_slug":"numa","prev_score":32,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 32 → 45. Problems weighed by who is responsible: incidents the subject suffered −9.6, concerns that are not fraud −9.6, problems around the subject, caused by others −0.8.","score_delta":13,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision a8f5203d-d223-4884-b7da-e718259a74a8copy
3. #3reviewby reviewerreviewer

   2026-11-02 05:02:27Z
   Score: 45 → 45 (no score change)
   The core incident facts, covering both exploits' dates, amounts, mechanisms, addresses and Tornado Cash laundering, match the vendor and primary sources I fetched. Problems found: the compensation-plan timeline date (the plan is bylined Apr 28, not Apr 21), the unsourced ZachXBT claim in the summary, an unverified audit-recommendation claim attributed to CertiK and Verichains, and a paraphrase of the team's compensation statement that I could not find in the source. Current operating status could not be determined.
   anchoranchored

   chain

   ●mainnet-betaslot 464,370,490

   sig

   4LWFx4iqBmvd…ygW6uHiqcopyexplorer ↗

   hash

   2dNjRmS3i5Rc…g1JAQAQVcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1362 B) ▸

   {"actor":"reviewer","artifact_identity":"0b16c62a70dac492049d04b84046870e","decided_at":"2026-11-02T05:02:27.510Z","decision":"review","disputed_pct":0.4286,"findings_hash":"5JAYh3CWsoSJs5g5dUN2p29EVXCT9Mx77EcmQJDWMuAD","investigation_id":"4e0807c8-b31e-45cb-8db3-3c303761446e","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":45,"omissions":{"material":0,"total":1},"page_content_hash":"ac937b7aa331b0ca0cf0c8ad133a6c23174e0cd0a757d2dc131f44168aacdd05","page_slug":"numa","prev_score":45,"reason":"The core incident facts, covering both exploits' dates, amounts, mechanisms, addresses and Tornado Cash laundering, match the vendor and primary sources I fetched. Problems found: the compensation-plan timeline date (the plan is bylined Apr 28, not Apr 21), the unsourced ZachXBT claim in the summary, an unverified audit-recommendation claim attributed to CertiK and Verichains, and a paraphrase of the team's compensation statement that I could not find in the source. Current operating status could not be determined.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":3,"subject_status":"unknown","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision e566a96f-6481-441d-87f6-5c5bdb76f70acopy
4. #4review reviseby judgejudge

   2026-11-02 05:02:27Z
   Score: 45 → 45 (no score change)
   Three of seven reviewed claims (about 43%) were disputed or could not be verified. The compensation plan is dated 2025-04-21 but the source is bylined 2025-04-28 (claim_findings[1]). The summary says ZachXBT flagged the entity, but no source supports this (claim_findings[0]). The statement that CertiK and Verichains both concluded an audit with stress-testing was essential was not found in the CertiK analysis, and the Verichains page was not checked (claim_findings[6]). The core facts of both exploits, covering dates, amounts, addresses and Tornado Cash laundering, were confirmed (claim_findings[3], [4]). The penalty is kept at the low end of the band because the reviewer's confidence is only moderate and the problems sit in secondary claims, not the core allegations.
   anchoranchored

   chain

   ●mainnet-betaslot 464,370,495

   sig

   3ZK8PYWrZ3XU…k7PYkWM6copyexplorer ↗

   hash

   41NdSkEczSyL…xVKeEebqcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1416 B) ▸

   {"actor":"judge","artifact_identity":"0b16c62a70dac492049d04b84046870e","band_override":null,"decided_at":"2026-11-02T05:02:27.510Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.4286,"investigation_id":"4e0807c8-b31e-45cb-8db3-3c303761446e","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":45,"page_slug":"numa","prev_score":45,"reason":"Three of seven reviewed claims (about 43%) were disputed or could not be verified. The compensation plan is dated 2025-04-21 but the source is bylined 2025-04-28 (claim_findings[1]). The summary says ZachXBT flagged the entity, but no source supports this (claim_findings[0]). The statement that CertiK and Verichains both concluded an audit with stress-testing was essential was not found in the CertiK analysis, and the Verichains page was not checked (claim_findings[6]). The core facts of both exploits, covering dates, amounts, addresses and Tornado Cash laundering, were confirmed (claim_findings[3], [4]). The penalty is kept at the low end of the band because the reviewer's confidence is only moderate and the problems sit in secondary claims, not the core allegations.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 588e39a5-ec22-4db1-8393-b9eaeafa1babcopy
5. #5rescoreby systemsystem

   2026-11-02 05:02:28Z
   Score: 45 → 48 (+3)
   Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 45 → 48. Problems weighed by who is responsible: incidents the subject suffered −9.6, concerns that are not fraud −6.4, problems around the subject, caused by others −0.8; 1 section(s) set aside until a failed fact-check is resolved.
   anchoranchored

   chain

   ●mainnet-betaslot 464,370,501

   sig

   4tQvHVqHqRDG…STW48VMmcopyexplorer ↗

   hash

   574iHnPHEtZU…t8tMxNbrcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (710 B) ▸

   {"actor":"system","decided_at":"2026-11-02T05:02:27.510Z","decision":"rescore","investigation_id":"4e0807c8-b31e-45cb-8db3-3c303761446e","new_score":48,"page_slug":"numa","prev_score":45,"reason":"Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 45 → 48. Problems weighed by who is responsible: incidents the subject suffered −9.6, concerns that are not fraud −6.4, problems around the subject, caused by others −0.8; 1 section(s) set aside until a failed fact-check is resolved.","score_delta":3,"score_model":"v2","sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 87520eff-99f6-4e1f-a6f7-3bca6ad85510copy