Audit log

Every state-changing event for OKX NFT Aggregator: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.

1. #1publishby system:backfill

   2026-05-29 16:12:52Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,972,341

   sig

   XNNDomdsPJSC…zeutLRZ1copyexplorer ↗

   hash

   7GzBcREuws6i…W2Ht6GNqcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6991 B) ▸

   {"actor":"system:backfill","investigation_id":"37d902e3-aec9-4679-8048-058ca5d1ebbb","kind":"publish","page_slug":"okx-nft-aggregator","published_at":"2026-05-29T16:12:52.466Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"OKX NFT Aggregator","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://arxiv.org/html/2508.02145v1","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.theblock.co/post/267405/okx-dex-suffers-apparent-2-7-million-exploit-following-suspected-private-key-leak","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/okx-dex-2-7-m-exploit-proxy-admin-contract-upgrade","type":"other","url":""},{"credibility":3,"name":"https://medium.com/neptune-mutual/understanding-the-okx-exploit-3fb7d826a621","type":"other","url":""},{"credibility":3,"name":"https://cryptobriefing.com/okx-dex-hacked-2-7-million-after-private-key-leak/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cryptoslate.com/okx-suspends-web3-aggregator-amid-probe-into-100m-bybit-hack-laundering-links/","type":"other","url":""},{"credibility":3,"name":"https://www.theblock.co/post/346538/okx-suspends-dex-aggregator-following-lazarus-misuse-and-heightened-eu-scrutiny","type":"other","url":""},{"credibility":3,"name":"https://www.bleepingcomputer.com/news/security/okx-suspends-dex-aggregator-after-lazarus-hackers-try-to-launder-funds/","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/okx-suspends-dex-aggregator-further-misuse-lazarus","type":"other","url":""},{"credibility":3,"name":"https://coinmarketcap.com/academy/article/okx-halts-dex-aggregator-services-amid-lazarus-group-misuse-and-eu-investigations","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.justice.gov/usao-sdny/pr/okx-pleads-guilty-violating-us-anti-money-laundering-laws-and-agrees-pay-penalties","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/business/2025/02/24/okx-close-to-large-settlement-agreement-with-u-s-regulators-source","type":"other","url":""},{"credibility":3,"name":"https://coinpedia.org/news/okx-pleads-guilty-to-u-s-violations-faces-500m-settlement/","type":"other","url":""},{"credibility":3,"name":"https://www.sanctions.io/blog/okxs-500-million-penalty-key-takeaways-for-aml-pros","type":"other","url":""},{"credibility":3,"name":"https://crypto.news/okx-non-compliance-settlement-doj-2025/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.okx.com/en-eu/help/okx-nft-marketplace-your-gateway-to-a-multi-chain-nft-universe","type":"other","url":""},{"credibility":3,"name":"https://www.globenewswire.com/news-release/2023/09/19/2745261/0/en/Flash-News-OKX-NFT-Marketplace-Witnesses-a-114-Rise-in-Daily-Trading-Volume.html","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/business/2023/12/19/okx-wallet-users-warned-to-update-app-to-avoid-code-vulnerability","type":"other","url":""},{"credibility":3,"name":"https://hackenproof.com/programs/okx","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://tradelize.com/crypto-exchange-reviews/okx-review/","type":"other","url":""},{"credibility":3,"name":"https://www.coinpedia.org/news/okx-pleads-guilty-to-u-s-violations-faces-500m-settlement/","type":"other","url":""},{"credibility":3,"name":"https://coinfomania.com/eus-okx-regulatory-investigation-eu-considers-stripping-okx-of-mica-license-following-1-5-billion-heist-fallout/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://crypto.news/exchanges-face-heat-as-okx-funds-zachxbt-probe-into-95-rave-crash/","type":"other","url":""},{"credibility":3,"name":"https://en.wikipedia.org/wiki/ZachXBT","type":"other","url":""},{"credibility":3,"name":"https://medium.com/neptune-mutual/understanding-the-okx-exploit-3fb7d826a621","type":"other","url":""},{"credibility":3,"name":"https://arxiv.org/html/2508.02145v1","type":"other","url":""}]}],"sources_used":[],"summary":"OKX NFT Aggregator is the NFT marketplace and aggregation layer of OKX, one of the world's largest crypto exchanges, supporting over 21 blockchains and 32 aggregated markets. The product has been implicated in a smart contract storage-collision exploit (June 2024), operates within an exchange that pleaded guilty to U.S. AML violations and agreed to a $504 million DOJ settlement (February 2025), and saw its parent DEX aggregator suspended in March 2025 after North Korea's Lazarus Group used the broader OKX Web3 infrastructure to launder approximately $100 million from the Bybit hack. ZachXBT has flagged the entity in the context of these broader OKX platform concerns.","timeline":[{"date":"2023-09-16","event":"OKX NFT Marketplace records single-day trading volume of $11.54 million, a 114.5% increase, reflecting rapid growth of the aggregator product.","source":""},{"date":"2023-12-12","event":"OKX DEX Proxy Admin Owner upgrades the proxy contract to a malicious implementation, opening the claimTokens exploit vector.","source":""},{"date":"2023-12-13","event":"OKX DEX exploited for approximately $2.7 million via compromised Proxy Admin private keys; OKX confirms the incident and pledges user compensation.","source":""},{"date":"2023-12-19","event":"CertiK discloses a critical Remote Code Execution vulnerability in OKX iOS wallet app (version prior to 6.45.0); OKX patches immediately.","source":""},{"date":"2024-02-24","event":"CFTC issues a subpoena to OKX referencing alleged fraud and illegal activities in digital asset transactions.","source":""},{"date":"2024-06-20","event":"OKX NFT Aggregator suffers a smart contract storage-collision exploit during a contract upgrade; part of a combined ~$6.9 million loss across OKX NFT Aggregator, EFVault, and PikeFinance.","source":""},{"date":"2025-02-21","event":"Lazarus Group executes the $1.5 billion Bybit hack; approximately $100 million is subsequently routed through OKX Web3 DEX aggregator infrastructure.","source":""},{"date":"2025-02-24","event":"Aux Cayes Fintech Co. Ltd (OKX operator) pleads guilty in SDNY to operating an unlicensed money transmitting business, agreeing to pay $504 million in penalties and forfeitures.","source":""},{"date":"2025-03-06","event":"ESMA convenes meeting with representatives of all 27 EU member states to discuss OKX's role in Bybit hack laundering and MiCA compliance status.","source":""},{"date":"2025-03-17","event":"OKX voluntarily suspends its DEX aggregator service, citing Lazarus Group misuse and the need for security upgrades including real-time hacker-address blocking.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 8823bb54-7d38-442f-8208-c7fe0b3f770bcopy
2. #2reviewby reviewerreviewer

   2026-06-13 22:10:30Z
   Score: 42 → 42 (no score change)
   The page's core factual claims about the DOJ settlement, DEX exploit, CertiK vulnerability, and DEX aggregator suspension are broadly confirmed by credible sources. However, the ZachXBT claim is materially disputed — the only sourced ZachXBT-OKX connection shows OKX funding ZachXBT's investigation, not ZachXBT flagging OKX. The $6.9M combined loss figure is real but the NFT Aggregator's individual share was approximately $14,000 per the arxiv source, and the page implies a larger direct loss. A structural data integrity issue renders all 7 section bodies empty, meaning the page's entire substantive content resides only in the summary and timeline.
   anchoranchored

   chain

   ●mainnet-betaslot 426,286,838

   sig

   66Ft6a35MAHu…8GN3iD7Ucopyexplorer ↗

   hash

   6BmH5d5ic7Xg…DpUhswt5copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1009 B) ▸

   {"actor":"reviewer","decided_at":"2026-06-13T22:10:29.929Z","decision":"review","investigation_id":"37d902e3-aec9-4679-8048-058ca5d1ebbb","new_score":42,"page_slug":"okx-nft-aggregator","prev_score":42,"reason":"The page's core factual claims about the DOJ settlement, DEX exploit, CertiK vulnerability, and DEX aggregator suspension are broadly confirmed by credible sources. However, the ZachXBT claim is materially disputed — the only sourced ZachXBT-OKX connection shows OKX funding ZachXBT's investigation, not ZachXBT flagging OKX. The $6.9M combined loss figure is real but the NFT Aggregator's individual share was approximately $14,000 per the arxiv source, and the page implies a larger direct loss. A structural data integrity issue renders all 7 section bodies empty, meaning the page's entire substantive content resides only in the summary and timeline.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d621a69c-9e6c-45a0-99ad-7834537c5166copy
3. #3review reviseby judgejudge

   2026-06-13 22:10:30Z
   Score: 42 → 30 (-12)
   One claim is materially disputed (claim_findings[4]): the ZachXBT citation inverts the actual relationship — OKX funded ZachXBT's investigation into a third party, not the reverse. This mischaracterizes the source and should be removed or corrected. Five further claims are only partially supported, most notably the implied scale of the OKX NFT Aggregator's direct loss in the June 2024 storage-collision exploit (its individual exposure was approximately $14,000, not a meaningful share of the $6.9M combined total) and the framing of Lazarus Group laundering as completed rather than attempted and partially blocked. Two high-priority structural gaps also require attention: all seven page sections have empty content bodies, making the page unpublishable in its current form, and multiple incidents attributed to the OKX NFT Aggregator actually involve the broader OKX exchange or DEX arm. Core claims — the $504M DOJ settlement, the December 2023 DEX exploit, the CertiK RCE disclosure, and the March 2025 DEX aggregator suspension — are confirmed by Tier 1 sources and are not at issue.
   anchoranchored

   chain

   ●mainnet-betaslot 426,286,841

   sig

   56RpRzTRPkyb…t3FMRUR6copyexplorer ↗

   hash

   BammkpmaJQxN…dSp6V4pXcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1452 B) ▸

   {"actor":"judge","decided_at":"2026-06-13T22:10:29.929Z","decision":"review_revise","investigation_id":"37d902e3-aec9-4679-8048-058ca5d1ebbb","new_score":30,"page_slug":"okx-nft-aggregator","prev_score":42,"reason":"One claim is materially disputed (claim_findings[4]): the ZachXBT citation inverts the actual relationship — OKX funded ZachXBT's investigation into a third party, not the reverse. This mischaracterizes the source and should be removed or corrected. Five further claims are only partially supported, most notably the implied scale of the OKX NFT Aggregator's direct loss in the June 2024 storage-collision exploit (its individual exposure was approximately $14,000, not a meaningful share of the $6.9M combined total) and the framing of Lazarus Group laundering as completed rather than attempted and partially blocked. Two high-priority structural gaps also require attention: all seven page sections have empty content bodies, making the page unpublishable in its current form, and multiple incidents attributed to the OKX NFT Aggregator actually involve the broader OKX exchange or DEX arm. Core claims — the $504M DOJ settlement, the December 2023 DEX exploit, the CertiK RCE disclosure, and the March 2025 DEX aggregator suspension — are confirmed by Tier 1 sources and are not at issue.","score_delta":-12,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 57d97566-8eae-4741-8612-091042c7c788copy