Audit log

Every state-changing event for Onyx Protocol: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-28 08:20:43Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,682,732

   sig

   5c7JgSEiwYTH…NtNNLbxfcopyexplorer ↗

   hash

   73MfqsETBVvS…aBqmQccDcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6467 B) ▸

   {"actor":"system:backfill","investigation_id":"ef9d20ac-7b82-459a-84c2-2560148b7857","kind":"publish","page_slug":"onyx-protocol","published_at":"2026-05-28T08:20:43.598Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Onyx Protocol","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.weex.com/questions/article/who-is-behind-onyxcoin-xcn-crypto-the-full-story-explained-67773","type":"other","url":""},{"credibility":3,"name":"https://www.withtap.com/blog/what-is-chain-xcn","type":"other","url":""},{"credibility":3,"name":"https://www.gate.com/learn/articles/what-is-onyx-protocol-all-you-need-to-know-about-xcn/4336","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://hacken.io/discover/onyx-protocol-hack/","type":"other","url":""},{"credibility":3,"name":"https://www.certik.com/resources/blog/post-mortem-onyx-protocol","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-onyx-protocol-hack-october-2023","type":"other","url":""},{"credibility":3,"name":"https://www.merklescience.com/blog/onyx-protocol-hack-flow-of-funds-analysis","type":"other","url":""},{"credibility":3,"name":"https://crypto.news/hackers-exploit-onyx-protocol-for-2-1m/","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2023/11/01/onyx-protocol-lost-2-1-million-in-a-latest-exploit/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-onyx-protocol-hack-september-2024","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/onyx-protocol-rekt2","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/onyx-protocol-preventable-hack/","type":"other","url":""},{"credibility":3,"name":"https://dailyhodl.com/2024/09/27/decentralized-web3-project-onyx-hacked-for-3800000-worth-of-crypto-peckshield/","type":"other","url":""},{"credibility":3,"name":"https://www.quillaudits.com/blog/hack-analysis/onyx-dao-hack","type":"other","url":""},{"credibility":3,"name":"https://www.cryptopolitan.com/onyx-protocol-hacked-again-for-3-8m-through-exchange-rate-exploit/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.certik.com/resources/blog/post-mortem-onyx-protocol","type":"other","url":""},{"credibility":3,"name":"https://hacken.io/discover/onyx-protocol-hack/","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/onyx-protocol-preventable-hack/","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-onyx-protocol-hack-september-2024","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cointelegraph.com/news/onyx-core-relaunch-after-3-8m-hack","type":"other","url":""},{"credibility":3,"name":"https://www.coininsider.com/news/2024/09/onyx-shuts-ethereum-lending-market-relaunches-as-onyx-core/","type":"other","url":""},{"credibility":3,"name":"https://financefeeds.com/defi-protocol-onyx-to-relaunch-after-3-8-million/","type":"other","url":""},{"credibility":3,"name":"https://www.bitget.com/news/detail/12560604240361","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[]}],"sources_used":[],"summary":"Onyx Protocol is a DeFi lending protocol forked from Compound Finance v2, operating on Ethereum and issuing the XCN (Onyxcoin) token. The protocol suffered two major exploits in under twelve months — $2.1 million in October/November 2023 and $3.8 million in September 2024 — both stemming from the same known precision vulnerability in the Compound v2 codebase that the team had been warned about by auditor CertiK in February 2023 and chose not to remediate. Following the second hack the Ethereum-based lending market was shut down and the protocol relaunched as Onyx Core.","timeline":[{"date":"2014-01-01","event":"Adam Ludwin founds Chain, the predecessor company to Onyx Protocol, raising approximately $40 million from institutional investors including Nasdaq, Visa, and Citigroup.","source":""},{"date":"2018-01-01","event":"Chain is acquired by Lightyear Corp., a commercial subsidiary of the Stellar Development Foundation.","source":""},{"date":"2022-03-01","event":"Token rebranded from CHN to XCN at a 1:1,000 ratio; 5 billion XCN burned and 15 billion XCN donated to a new foundation.","source":""},{"date":"2023-01-01","event":"Governance proposal CIP-007 passes, officially renaming Chain Protocol to Onyx Protocol and Chain DAO to Onyx DAO.","source":""},{"date":"2023-02-27","event":"CertiK publishes audit report identifying the empty-pool/precision vulnerability in the Compound v2 fork code and explicitly recommending remediation. The Onyx team acknowledges the finding and decides not to act.","source":""},{"date":"2023-10-23","event":"Governance proposal to support a PEPE token market on Onyx passes with approximately 11 votes, majority from a single address.","source":""},{"date":"2023-10-26","event":"PEPE market contract deployed on Onyx with zero initial liquidity, creating the conditions for an empty-pool exploit.","source":""},{"date":"2023-11-01","event":"First exploit: attackers drain approximately 1,164 ETH ($2.1 million) from Onyx Protocol via the empty PEPE pool. TVL collapses 87%. Attacker address: 0x085bdff2c522e8637d4154039db8746bb8642bff.","source":""},{"date":"2024-09-26","event":"Second exploit: attacker (0x680910cf5Fc9969A25Fd57e7896A14fF1E55F36B) drains $3.8 million from Onyx Protocol using the same Compound v2 precision vulnerability plus an NFTLiquidation contract input-validation flaw. Assets stolen: 4.1M VUSD, 7.35M XCN, 0.23 WBTC, 5K DAI, 50K USDT.","source":""},{"date":"2024-09-29","event":"Governance proposal OIP-46 passes with 100% community support, approving shutdown of the Ethereum lending market, full lender reimbursement, and relaunch as Onyx Core.","source":""},{"date":"2024-10-01","event":"Onyx Core scheduled relaunch; Ethereum-based open lending market shut down.","source":""},{"date":"2025-02-01","event":"Onyx team announces development of the Onyx XCN Ledger, a Layer 3 blockchain built on Arbitrum Orbit using Coinbase Base as settlement layer, alongside a new whitepaper.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 02d3f849-551a-43a1-9662-05188f024836copy
2. #2reviewby reviewerreviewer

   2026-11-02 04:18:08Z
   Score: 22 → 22 (no score change)
   The core facts check out against CertiK and Rekt: the Feb 2023 audit warning, the Nov 2023 $2.1M exploit and the Sep 2024 $3.8M exploit with its assets and addresses. One point is disputed: who reported the second exploit first. Several claims were not checked, among them the ETH amount, the vote count, the background history and the relaunch status. The page's status coverage may be out of date, since snippets suggest a 2026 Goliath mainnet launch, but I could not confirm that.
   anchoranchored

   chain

   ●mainnet-betaslot 464,358,086

   sig

   61QjDFJgGFoN…C24mGJXTcopyexplorer ↗

   hash

   AGYpMCugtwqE…CuyLgc4vcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1334 B) ▸

   {"actor":"reviewer","artifact_identity":"ea28413de2ed5a3a024dd51416e3981c","decided_at":"2026-11-02T04:18:08.913Z","decision":"review","disputed_pct":0.5714,"findings_hash":"HdjPKLa47MWDN1uwMfpYvc41hy2ZPDQpUYiE7XTGD9nx","investigation_id":"ef9d20ac-7b82-459a-84c2-2560148b7857","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":22,"omissions":{"material":0,"total":1},"page_content_hash":"7f48e20c2bcb6d854292789b492f31b1de4e365ec65e7f731bd6810ab5c17b84","page_slug":"onyx-protocol","prev_score":22,"reason":"The core facts check out against CertiK and Rekt: the Feb 2023 audit warning, the Nov 2023 $2.1M exploit and the Sep 2024 $3.8M exploit with its assets and addresses. One point is disputed: who reported the second exploit first. Several claims were not checked, among them the ETH amount, the vote count, the background history and the relaunch status. The page's status coverage may be out of date, since snippets suggest a 2026 Goliath mainnet launch, but I could not confirm that.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":2,"subject_status":"unknown","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision a55550b9-3d24-4185-bcaa-fb4b1e469b93copy
3. #3review reviseby judgejudge

   2026-11-02 04:18:09Z
   Score: 22 → 6 (-16)
   Of 7 claims reviewed, 3 could not be verified and 1 was disputed, giving a disputed share of about 57%. The core facts (the February 2023 CertiK warning, the $2.1M exploit in November 2023 and the $3.8M exploit in September 2024) were confirmed by CertiK and Rekt (claim_findings[0], [1], [3]). However, claim_findings[4] was disputed because Rekt credits Cyvers, not PeckShield, with flagging the second exploit first. claim_findings[2], [5] and [6] (attacker address and ETH amount, the relaunch as Onyx Core, the XCN rebrand) were not verified, and several of those were not checked at all. The penalty is kept at the lower end of the band because the reviewer's confidence is low (0.4) and the confirmed claims cover the central allegations.
   anchoranchored

   chain

   ●mainnet-betaslot 464,358,090

   sig

   2HR91R1p6kAQ…R8mWf3Whcopyexplorer ↗

   hash

   E5hPvi44k88g…2k5wMvQScopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1393 B) ▸

   {"actor":"judge","artifact_identity":"ea28413de2ed5a3a024dd51416e3981c","band_override":null,"decided_at":"2026-11-02T04:18:08.913Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.5714,"investigation_id":"ef9d20ac-7b82-459a-84c2-2560148b7857","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":6,"page_slug":"onyx-protocol","prev_score":22,"reason":"Of 7 claims reviewed, 3 could not be verified and 1 was disputed, giving a disputed share of about 57%. The core facts (the February 2023 CertiK warning, the $2.1M exploit in November 2023 and the $3.8M exploit in September 2024) were confirmed by CertiK and Rekt (claim_findings[0], [1], [3]). However, claim_findings[4] was disputed because Rekt credits Cyvers, not PeckShield, with flagging the second exploit first. claim_findings[2], [5] and [6] (attacker address and ETH amount, the relaunch as Onyx Core, the XCN rebrand) were not verified, and several of those were not checked at all. The penalty is kept at the lower end of the band because the reviewer's confidence is low (0.4) and the confirmed claims cover the central allegations.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":-16,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision af55a627-b84a-4ab8-962e-1394daf30868copy