Audit log

Every state-changing event for Orbit Bridge: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-20 15:41:10Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 421,014,726

   sig

   2XtCQyphrj5o…5zVSv12xcopyexplorer ↗

   hash

   9Rr5BR22K2tk…vuuEohWrcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (7640 B) ▸

   {"actor":"system:backfill","investigation_id":"4e61eb7d-03f2-41e4-b415-2f288389f598","kind":"publish","page_slug":"orbit-bridge","published_at":"2026-05-20T15:41:10.055Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Orbit Bridge","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2024/01/02/orbit-chain-loses-81m-in-cross-chain-bridge-exploit"},{"credibility":3,"name":"","type":"other","url":"https://blockworks.co/news/80-million-lost-orbit-bridge"},{"credibility":3,"name":"","type":"other","url":"https://www.newsbtc.com/news/company/ton-foundation-bolsters-drive-to-a-cross-chain-future-together-with-ozys-orbit-bridge/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://news.bitcoin.com/orbit-bridge-hack-confirmed-over-81-5-million-lost-in-cryptocurrency-assets/"},{"credibility":3,"name":"","type":"other","url":"https://rekt.news/orbit-bridge-rekt"},{"credibility":3,"name":"","type":"other","url":"https://www.bankinfosecurity.com/cryptohack-roundup-orbit-chains-81m-new-years-eve-hack-a-24028"},{"credibility":3,"name":"","type":"other","url":"https://therecord.media/korean-police-investigating-cryptocurrency-theft-orbit-chain"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://rekt.news/orbit-bridge-rekt"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/299192/orbit-chain-exploiter-moves-48-million-through-tornado-cash-after-months-of-post-hack-dormancy"},{"credibility":3,"name":"","type":"other","url":"https://blockchain.news/flashnews/eth-alert-orbit-chain-hack-wallet-launders-4-320-eth-via-tornado-cash"},{"credibility":3,"name":"","type":"other","url":"https://dailycoin.com/orbit-chain-hacker-online-48m-tornado-cash/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://cryptonews.com/news/south-korean-agencies-investigate-82m-orbit-bridge-hack/"},{"credibility":3,"name":"","type":"other","url":"https://icoholder.com/en/news/lazarus-group-suspected-in-orbit-chain-hack-blockchain-analysts-uncover-common-tactics-in-high-profile-attacks"},{"credibility":3,"name":"","type":"other","url":"https://cryptonews.com/news/orbit-bridge-hacker-suspected-in-coinspaid-and-coinex-breaches/"},{"credibility":3,"name":"","type":"other","url":"https://therecord.media/korean-police-investigating-cryptocurrency-theft-orbit-chain"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/274411/orbit-bridge-firewall-sabotage-exploit"},{"credibility":3,"name":"","type":"other","url":"https://dailycoin.com/ozys-blames-former-ciso-for-81-5m-orbit-bridge-exploit/"},{"credibility":3,"name":"","type":"other","url":"https://crypto.news/ex-orbit-bridge-employee-accused-of-facilitating-80m-attack/"},{"credibility":3,"name":"","type":"other","url":"https://bsc.news/post/orbit-bridge-accuses-former-team-member-for-82m-hack"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://medium.com/orbit-chain/orbit-bridge-exploit-asset-recovery-and-ecosystem-normalization-plan-draft-3aa7ac2a6e4a"},{"credibility":3,"name":"","type":"other","url":"https://medium.com/orbit-chain/governance-proposal-for-the-renewal-of-orbit-chain-orc-tokens-a278eb3af1ce"},{"credibility":3,"name":"","type":"other","url":"https://blockchain.news/flashnews/eth-alert-orbit-chain-hack-wallet-launders-4-320-eth-via-tornado-cash"},{"credibility":3,"name":"","type":"other","url":"https://livedarknet.com/p/negotiations-fail-after-82m-orbit-bridge-hack/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-orbit-bridge-hack-december-2023"},{"credibility":3,"name":"","type":"other","url":"https://www.infosecurity-magazine.com/news/crypto-stolen-cyber-attack-orbit/"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/orbit-bridge-hack-pushes-december-crypto-losses-100m"}]}],"sources_used":[],"summary":"Orbit Bridge is a cross-chain interoperability protocol developed by South Korean blockchain firm Ozys that suffered one of the largest bridge exploits in crypto history on December 31, 2023, losing approximately $81.5 million in ETH, WBTC, USDT, USDC, and DAI. The attacker allegedly compromised seven of ten multisig signatories after a former chief information security officer allegedly weakened the company firewall before departing, and blockchain analysts have linked the attack's patterns to North Korea's Lazarus Group, though no formal attribution has been confirmed by authorities. As of 2025, the majority of stolen funds remain unrecovered, with the attacker having laundered over 17,000 ETH through Tornado Cash.","timeline":[{"date":"2023-11-20","event":"Orbit Bridge's CISO submits voluntary resignation request to Ozys.","source":""},{"date":"2023-11-22","event":"Alleged: Former CISO makes unauthorized changes to Ozys internal firewall policies, weakening security posture (alleged by Ozys; unproven in court).","source":""},{"date":"2023-12-06","event":"Former CISO formally departs Ozys without disclosing firewall changes.","source":""},{"date":"2023-12-31","event":"Exploit begins at 21:08 UTC. Five unauthorized withdrawals drain 9,500 ETH, 231 WBTC, 30M USDT, 10M USDC, and 10M DAI from Orbit Bridge's Ethereum vault across approximately 17 minutes.","source":""},{"date":"2023-12-31","event":"Bridge contract deactivated at approximately 22:21 UTC to prevent further losses.","source":""},{"date":"2024-01-01","event":"Orbit Chain publicly confirms the exploit. National Intelligence Service notified by 10:35 a.m. KST.","source":""},{"date":"2024-01-02","event":"ChainLight engaged for forensic analysis. Orbit Chain attempts on-chain communication with attacker. Requests to exchanges to freeze stolen assets submitted.","source":""},{"date":"2024-01-03","event":"Match Systems publishes report alleging the Orbit attacker used tools and patterns consistent with Lazarus Group, and may have also conducted the Atomic Wallet, CoinsPaid, and CoinEx hacks.","source":""},{"date":"2024-01-10","event":"South Korea's NIS, National Police Agency, and KISA confirm joint investigation is underway. NIS states no direct North Korea link confirmed but possibility is being examined. Negotiations with attacker reported to have failed.","source":""},{"date":"2024-01-25","event":"Ozys publicly alleges former CISO deliberately weakened company firewall prior to the hack. Civil lawsuit and police petition filed against the unnamed former employee.","source":""},{"date":"2024-02-14","event":"Ozys publishes draft Asset Recovery and Ecosystem Normalization Plan, targeting $82M recovery over two years through company capital, partner grants, and new business revenue.","source":""},{"date":"2024-06-08","event":"After approximately five months of dormancy, attacker moves 12,932 ETH across seven transactions, routing approximately $48 million through Tornado Cash.","source":""},{"date":"2025-01-01","event":"Attacker transfers an additional 4,320 ETH (approximately $18.81 million) through Tornado Cash. Total laundered through Tornado Cash reaches 17,242 ETH (approximately $66.35 million). Attacker reported to still hold approximately 9,511 ETH and 20M DAI.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 1d12114c-c389-4a74-97e2-bce21232d899copy
2. #2rescoreby systemsystem

   2026-10-10 18:40:40Z
   Score: 10 → 49 (+39)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 49. Problems weighed by who is responsible: incidents the subject suffered −16, problems around the subject, caused by others −1.6; legitimacy credit long-running +2.
   anchoranchored

   chain

   ●mainnet-betaslot 455,359,191

   sig

   5LqQgVSZ4ife…t3ZeFwTAcopyexplorer ↗

   hash

   7zDSeDC1TFLK…A7j5wmPDcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (608 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:40:40.263Z","decision":"rescore","investigation_id":"4e61eb7d-03f2-41e4-b415-2f288389f598","new_score":49,"page_slug":"orbit-bridge","prev_score":10,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 49. Problems weighed by who is responsible: incidents the subject suffered −16, problems around the subject, caused by others −1.6; legitimacy credit long-running +2.","score_delta":39,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 9f3a02ed-dc2b-4ce7-99dc-925ab6c0970dcopy
3. #3rescoreby systemsystem

   2026-11-01 22:14:18Z
   Score: 49 → 53 (+4)
   Re-read and rescored after the page was re-researched (2026-11-01). Rescored under Scoring v2, the published formula (avoid.net/scoring): 49 → 53. Problems weighed by who is responsible: incidents the subject suffered −20, problems around the subject, caused by others −1.8; legitimacy credit long-running +10; the penalty for incidents it suffered is capped at 20.
   anchoranchored

   chain

   ●mainnet-betaslot 464,256,186

   sig

   2frWNBiG7a85…b97xwRgjcopyexplorer ↗

   hash

   HQxrYa4jefPR…XE73kYfmcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (731 B) ▸

   {"actor":"system","decided_at":"2026-11-01T22:14:17.012Z","decision":"rescore","investigation_id":"4e61eb7d-03f2-41e4-b415-2f288389f598","new_score":53,"page_slug":"orbit-bridge","prev_score":49,"reason":"Re-read and rescored after the page was re-researched (2026-11-01). Rescored under Scoring v2, the published formula (avoid.net/scoring): 49 → 53. Problems weighed by who is responsible: incidents the subject suffered −20, problems around the subject, caused by others −1.8; legitimacy credit long-running +10; the penalty for incidents it suffered is capped at 20.","score_delta":4,"score_model":"v2","sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d3c1264f-93b0-4ba6-95ac-dc8bfb845b7fcopy
4. #4reviewby reviewerreviewer

   2026-11-01 22:15:13Z
   Score: 53 → 53 (no score change)
   The two sources fetched (Rekt News, The Block) support the core facts: amounts, UTC timing and the CISO allegation timeline. The page is carefully hedged on Lazarus and the insider claims. One claim about the multisig threshold is not supported by Rekt, and the 'Both source pages' wording is internal process language. The mid-2025 cutoff is stale and no later status could be found. Many claims were not independently checked.
   anchoranchored

   chain

   ●mainnet-betaslot 464,256,476

   sig

   b2aDWUg59NXd…w6pKvZ7Vcopyexplorer ↗

   hash

   UHMQCHznwixV…4JMYQuLwcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1241 B) ▸

   {"actor":"reviewer","artifact_identity":"700e6251870d37150270db84d6509a98","decided_at":"2026-11-01T22:15:13.399Z","decision":"review","disputed_pct":0.3333,"findings_hash":"6aXM4sPzGHfwnBKPCEv3EhZd94K3tQ236LDM5CTN2tbB","investigation_id":"4e61eb7d-03f2-41e4-b415-2f288389f598","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":53,"page_content_hash":"bbb550b60180c792c6142453c915ab4a554dfa135e857a14c913c10468550f2b","page_slug":"orbit-bridge","prev_score":53,"reason":"The two sources fetched (Rekt News, The Block) support the core facts: amounts, UTC timing and the CISO allegation timeline. The page is carefully hedged on Lazarus and the insider claims. One claim about the multisig threshold is not supported by Rekt, and the 'Both source pages' wording is internal process language. The mid-2025 cutoff is stale and no later status could be found. Many claims were not independently checked.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"subject_status":"unknown","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 47e73f9e-7a78-4631-b9a3-b40a20982e04copy
5. #5review reviseby judgejudge

   2026-11-01 22:15:13Z
   Score: 53 → 53 (no score change)
   Of 6 claims checked, 3 were confirmed or partly supported against Rekt News and The Block (claim_findings[0], [1], [3] on amounts, timing and the CISO timeline). Two claims (claim_findings[4] and [5]) about the attacker's remaining holdings and the absence of recovery as of mid-2025 could not be verified and are now about 16 months out of date, which puts 2 of 6 (33%) in the significant band. claim_findings[2] cited Rekt for a multisig threshold that Rekt does not state, and uses internal wording ('Both source pages') that should not appear on a published page. Nothing was disputed and no shutdown, sanction or omission was found, and the reviewer's confidence was low (0.4), so the penalty is set at the mild end of the band.
   anchoranchored

   chain

   ●mainnet-betaslot 464,256,482

   sig

   4PmjjoGE4gTH…oTroE5Zxcopyexplorer ↗

   hash

   ubXXY7zVgefh…kFuWqL4dcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1379 B) ▸

   {"actor":"judge","artifact_identity":"700e6251870d37150270db84d6509a98","band_override":null,"decided_at":"2026-11-01T22:15:13.399Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.3333,"investigation_id":"4e61eb7d-03f2-41e4-b415-2f288389f598","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":53,"page_slug":"orbit-bridge","prev_score":53,"reason":"Of 6 claims checked, 3 were confirmed or partly supported against Rekt News and The Block (claim_findings[0], [1], [3] on amounts, timing and the CISO timeline). Two claims (claim_findings[4] and [5]) about the attacker's remaining holdings and the absence of recovery as of mid-2025 could not be verified and are now about 16 months out of date, which puts 2 of 6 (33%) in the significant band. claim_findings[2] cited Rekt for a multisig threshold that Rekt does not state, and uses internal wording ('Both source pages') that should not appear on a published page. Nothing was disputed and no shutdown, sanction or omission was found, and the reviewer's confidence was low (0.4), so the penalty is set at the mild end of the band.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d879eab6-52a8-4369-89eb-7c43c20481eacopy