Audit log

Every state-changing event for Onyx V2: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-28 03:28:45Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,638,462

   sig

   5ToEugWLqzRV…7J3vRo5Kcopyexplorer ↗

   hash

   4H9si3obFitJ…TPRjGzGLcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (8342 B) ▸

   {"actor":"system:backfill","investigation_id":"8748bbad-08ea-40ed-9e62-add2d3a037e6","kind":"publish","page_slug":"onyx-v2","published_at":"2026-05-28T03:28:45.352Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Onyx V2","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://hacken.io/discover/onyx-protocol-hack/","type":"other","url":""},{"credibility":3,"name":"https://www.gate.com/learn/articles/what-is-onyx-protocol-all-you-need-to-know-about-xcn/4336","type":"other","url":""},{"credibility":3,"name":"https://onyx-dao.gitbook.io/onyx-dao/resources/the-onyx-dao-team/","type":"other","url":""},{"credibility":3,"name":"https://www.certik.com/resources/blog/post-mortem-onyx-protocol","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/onyx-protocol-rekt","type":"other","url":""},{"credibility":3,"name":"https://hacken.io/discover/onyx-protocol-hack/","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-onyx-protocol-hack-october-2023","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2023/11/01/onyx-protocol-lost-2-1-million-in-a-latest-exploit/","type":"other","url":""},{"credibility":3,"name":"https://www.certik.com/resources/blog/post-mortem-onyx-protocol","type":"other","url":""},{"credibility":3,"name":"https://www.merklescience.com/blog/onyx-protocol-hack-flow-of-funds-analysis","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/onyx-protocol-rekt2","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-onyx-protocol-hack-september-2024","type":"other","url":""},{"credibility":3,"name":"https://www.theblock.co/post/318499/defi-protocol-onyx-hit-with-a-3-2-million-exploit-marking-second-attack-within-a-year","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/onyx-protocol-preventable-hack/","type":"other","url":""},{"credibility":3,"name":"https://thedefiant.io/news/defi/vusd-stablecoin-depegs-after-usd3-8-million-exploit-of-onyxdao","type":"other","url":""},{"credibility":3,"name":"https://dailyhodl.com/2024/09/27/decentralized-web3-project-onyx-hacked-for-3800000-worth-of-crypto-peckshield/","type":"other","url":""},{"credibility":3,"name":"https://www.aicoin.com/en/article/420947","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-onyx-protocol-hack-september-2024","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/onyx-protocol-preventable-hack/","type":"other","url":""},{"credibility":3,"name":"https://hacken.io/discover/onyx-protocol-hack/","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/onyx-protocol-rekt2","type":"other","url":""},{"credibility":3,"name":"https://metatrust.io/blogs/post/how-onyxs-governance-and-vulnerability-became-hackers-golden-shovels","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://community.onyx.org/t/oip-46-relaunch-onyx-core/1795","type":"other","url":""},{"credibility":3,"name":"https://coincodecap.com/onyx-set-to-relaunch-after-3-8-million-hack-backed-by-community-vote","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/onyx-core-relaunch-after-3-8m-hack","type":"other","url":""},{"credibility":3,"name":"https://www.cryptopolitan.com/onyx-to-relaunch-onyx-core-after-hack/","type":"other","url":""},{"credibility":3,"name":"https://www.bitget.com/news/detail/12560604240361","type":"other","url":""},{"credibility":3,"name":"https://www.cryptonewsnavigator.com/academy/article/onyxcoin-survival-thesis","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://coinmarketcap.com/currencies/onyxcoin/","type":"other","url":""},{"credibility":3,"name":"https://coingecko.com/en/coins/onyxcoin","type":"other","url":""},{"credibility":3,"name":"https://coingape.com/heres-why-onyxcoin-xcn-price-skyrockets-800-in-weeks/","type":"other","url":""},{"credibility":3,"name":"https://thedefiant.io/news/defi/vusd-stablecoin-depegs-after-usd3-8-million-exploit-of-onyxdao","type":"other","url":""},{"credibility":3,"name":"https://www.cryptonewsnavigator.com/academy/article/onyxcoin-price-prediction-survival-thesis","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/onyx-protocol-rekt","type":"other","url":""},{"credibility":3,"name":"https://hacken.io/discover/onyx-protocol-hack/","type":"other","url":""},{"credibility":3,"name":"https://metatrust.io/blogs/post/how-onyxs-governance-and-vulnerability-became-hackers-golden-shovels","type":"other","url":""},{"credibility":3,"name":"https://onyx-dao.gitbook.io/onyx-dao/resources/the-onyx-dao-team/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://coinmarketcap.com/cmc-ai/onyxcoin/latest-updates/","type":"other","url":""},{"credibility":3,"name":"https://messari.io/project/onyx-protocol","type":"other","url":""}]}],"sources_used":[],"summary":"Onyx Protocol is a Compound Finance fork and DeFi lending platform on Ethereum that launched a V2 iteration in 2024 following two devastating exploits — one in November 2023 ($2.1M) and a second in September 2024 ($3.8M) — both exploiting the same known vulnerability in the Compound V2 codebase. After the second hack, the community voted to shut down the Ethereum lending market and relaunch as Onyx Core; V2 targeting compliance with the U.S. CLARITY Act launched in Q3 2025 on a new XCN Ledger infrastructure. Total confirmed losses across both exploits exceed $5.9 million.","timeline":[{"date":"2022-01-01","event":"CertiK completes audit of Onyx Protocol — the last known independent security audit. Subsequent protocol updates and new market deployments were not re-audited.","source":""},{"date":"2023-10-01","event":"Onyx DAO passes governance Proposal 22 adding an unfunded PEPE market; only 11 total votes cast with one address controlling ~97% of vote weight.","source":""},{"date":"2023-11-02","event":"First exploit: attacker (0x085bdff2c522e8637d4154039db8746bb8642bff) drains $2.1 million (1,164 ETH) using an empty-pool rounding error in the Compound V2 fork. 1,140 ETH deposited to Tornado Cash. TVL drops 87%.","source":""},{"date":"2024-01-01","event":"Onyx DAO passes recovery proposals including plans to launch V2 money market with security improvements targeting the rounding-error vulnerability.","source":""},{"date":"2024-09-26","event":"Second exploit: attacker (0x680910cf5Fc9969A25Fd57e7896A14fF1E55F36B) drains $3.8 million using the same Compound V2 exchange-rate manipulation plus a new NFTLiquidation contract flaw. Stolen assets include 4.1M VUSD, 7.35M XCN, 50K USDT, 5K DAI, 0.23 WBTC.","source":""},{"date":"2024-09-26","event":"VUSD stablecoin depegs to $0.2757 — a 72% decline within 24 hours of the exploit.","source":""},{"date":"2024-09-27","event":"OIP-46 (Relaunch Onyx Core) proposed. Protocol announces shutdown of Ethereum lending market and 1:1 lender reimbursement commitment.","source":""},{"date":"2024-09-29","event":"OIP-46 passes with 100% community approval (no opposition votes recorded).","source":""},{"date":"2024-10-01","event":"OIP-46 executed. Ethereum lending market shut down; Onyx Core relaunch initiated.","source":""},{"date":"2025-01-01","event":"XCN token surges approximately 1,500% to $0.05 in a speculative rally before falling ~85%.","source":""},{"date":"2025-08-01","event":"OIP-60 deployed: Onyx Points rewards for stakers activated; gas-free wallet launched; Onyx AI v2 and website overhaul released.","source":""},{"date":"2025-10-01","event":"Onyx V2 launches natively on XCN Ledger (Layer 3) with gas-free transactions, Arbitrum Nitro EVM compatibility, and CLARITY Act compliance positioning.","source":""},{"date":"2026-03-27","event":"Goliath proof-of-stake Layer 1 mainnet goes live as part of the expanded Onyx ecosystem.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 0bc09b60-4cf9-46a4-b54b-9e4efafd04d0copy
2. #2rescoreby systemsystem

   2026-10-10 18:49:05Z
   Score: 22 → 52 (+30)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 22 → 52. Problems weighed by who is responsible: concerns that are not fraud −12.8, incidents the subject suffered −6.4, problems around the subject, caused by others −1.6; legitimacy credit long-running +8.
   anchoranchored

   chain

   ●mainnet-betaslot 455,369,003

   sig

   2HCGeFRA42pQ…bAk6rp6mcopyexplorer ↗

   hash

   DarcrqmTCUME…23rbioYacopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (639 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:49:05.055Z","decision":"rescore","investigation_id":"8748bbad-08ea-40ed-9e62-add2d3a037e6","new_score":52,"page_slug":"onyx-v2","prev_score":22,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 22 → 52. Problems weighed by who is responsible: concerns that are not fraud −12.8, incidents the subject suffered −6.4, problems around the subject, caused by others −1.6; legitimacy credit long-running +8.","score_delta":30,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 2d481989-1b00-4780-a14d-afbc1081eb23copy
3. #3reviewby reviewerreviewer

   2026-11-02 04:47:23Z
   Score: 52 → 52 (no score change)
   The core exploit narrative holds: the second-exploit figures, attacker address, transaction hash and flash-loan details match rekt, and the first-exploit amounts, address, Tornado Cash split and Proposal 22 vote concentration match rekt. The main defect is that the first exploit is dated 2 Nov 2023, which is rekt's publication date. The exploit happened on Tuesday 31 Oct 2023. Two quoted passages (rekt on community vigilance and Halborn on the same vulnerability) were not found verbatim. The 87% TVL drop and the 100% OIP-46 approval were not located in the sources read. The V2 launch date is inconsistent across the summary, timeline and section. The XCN price is dated May 2026 and is likely stale. No current shutdown, exploit or sanction was found.
   anchoranchored

   chain

   ●mainnet-betaslot 464,366,307

   sig

   4aBbd98x199U…UeZUxadwcopyexplorer ↗

   hash

   BcYoMrfkevwL…P2tWTHddcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1602 B) ▸

   {"actor":"reviewer","artifact_identity":"9bfc1e5b4ec7c58ad8aafe2bcccb9c67","decided_at":"2026-11-02T04:47:23.231Z","decision":"review","disputed_pct":0.5,"findings_hash":"Ab8w9GVdCdpnt7ZvRRZ6fPaXwGkXYDR6DMdyhzfDhpPx","investigation_id":"8748bbad-08ea-40ed-9e62-add2d3a037e6","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":52,"omissions":{"material":0,"total":1},"page_content_hash":"69a3f335d75f9917b349dcc2ac54336133ac000072d46bae9b021a7c474f654d","page_slug":"onyx-v2","prev_score":52,"reason":"The core exploit narrative holds: the second-exploit figures, attacker address, transaction hash and flash-loan details match rekt, and the first-exploit amounts, address, Tornado Cash split and Proposal 22 vote concentration match rekt. The main defect is that the first exploit is dated 2 Nov 2023, which is rekt's publication date. The exploit happened on Tuesday 31 Oct 2023. Two quoted passages (rekt on community vigilance and Halborn on the same vulnerability) were not found verbatim. The 87% TVL drop and the 100% OIP-46 approval were not located in the sources read. The V2 launch date is inconsistent across the summary, timeline and section. The XCN price is dated May 2026 and is likely stale. No current shutdown, exploit or sanction was found.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":3,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 2bc9af3c-5415-485f-bd49-ed58ed3b2c6acopy
4. #4review reviseby judgejudge

   2026-11-02 04:47:23Z
   Score: 52 → 52 (no score change)
   Of 12 reviewed claims, 2 were disputed and 4 could not be verified, giving a disputed rate of 50%. The first exploit is dated 2 November 2023 in both the timeline and the narrative (claim_findings[0], [1]), but that is the publication date of the source article. The exploit happened on 31 October 2023. The 87% TVL drop, the 100% OIP-46 approval, a rekt.news quote and the CertiK audit claims were not found in the sources checked (claim_findings[2], [6], [10]), and the V2 launch date is inconsistent across the page (claim_findings[8]). The core exploit facts for both hacks (amounts, addresses, transaction hash, Tornado Cash split) match the sources, and no shutdown or sanction was found, so the penalty sits at the lower end of the band. The reviewer's confidence was moderate (0.55) and many cited sources were not fetched.
   anchoranchored

   chain

   ●mainnet-betaslot 464,366,312

   sig

   5KHUhhN12wkt…QT2FDdxccopyexplorer ↗

   hash

   FV7XnjTXAh3e…CXR4jSgocopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1469 B) ▸

   {"actor":"judge","artifact_identity":"9bfc1e5b4ec7c58ad8aafe2bcccb9c67","band_override":null,"decided_at":"2026-11-02T04:47:23.231Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.5,"investigation_id":"8748bbad-08ea-40ed-9e62-add2d3a037e6","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":52,"page_slug":"onyx-v2","prev_score":52,"reason":"Of 12 reviewed claims, 2 were disputed and 4 could not be verified, giving a disputed rate of 50%. The first exploit is dated 2 November 2023 in both the timeline and the narrative (claim_findings[0], [1]), but that is the publication date of the source article. The exploit happened on 31 October 2023. The 87% TVL drop, the 100% OIP-46 approval, a rekt.news quote and the CertiK audit claims were not found in the sources checked (claim_findings[2], [6], [10]), and the V2 launch date is inconsistent across the page (claim_findings[8]). The core exploit facts for both hacks (amounts, addresses, transaction hash, Tornado Cash split) match the sources, and no shutdown or sanction was found, so the penalty sits at the lower end of the band. The reviewer's confidence was moderate (0.55) and many cited sources were not fetched.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 23306c3b-bf3a-4ae7-80d9-c1724b4d838acopy
5. #5rescoreby systemsystem

   2026-11-02 04:47:24Z
   Score: 52 → 59 (+7)
   Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 52 → 59. Problems weighed by who is responsible: concerns that are not fraud −9.6, incidents the subject suffered −3.2, problems around the subject, caused by others −0.8; legitimacy credit long-running +8; 3 section(s) set aside until a failed fact-check is resolved.
   anchoranchored

   chain

   ●mainnet-betaslot 464,366,317

   sig

   4c7hcxz3LJZt…LfNKNuEycopyexplorer ↗

   hash

   6h7bBf23tchk…wpWj9KkScopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (748 B) ▸

   {"actor":"system","decided_at":"2026-11-02T04:47:23.231Z","decision":"rescore","investigation_id":"8748bbad-08ea-40ed-9e62-add2d3a037e6","new_score":59,"page_slug":"onyx-v2","prev_score":52,"reason":"Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 52 → 59. Problems weighed by who is responsible: concerns that are not fraud −9.6, incidents the subject suffered −3.2, problems around the subject, caused by others −0.8; legitimacy credit long-running +8; 3 section(s) set aside until a failed fact-check is resolved.","score_delta":7,"score_model":"v2","sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 11417e53-96d0-40f8-9509-dfa37b997f09copy