Fact-check findings
What an automated fact-checker found when it re-read Orbit Bridge against the sources the page cites. Only the most recent review is shown.
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
2 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #5[unverifiable][awaiting moderator]in section: On-chain evidence and laundering of stolen funds
“As of mid-2025 the attacker's address was reported to still hold approximately 9,511 ETH and 20 million DAI.”
reviewerAs of mid-2025 attacker address still held about 9,511 ETH and 20M DAI; total laundered 17,242 ETH.Not fetched or independently confirmed. The page's figures are also stale relative to the 2026-11 review date. - #6[unverifiable][awaiting moderator]in the summary
“no material recovery had been reported as of mid-2025”
reviewerNo material recovery of stolen funds had been reported as of mid-2025.Search found nothing after mid-2024 either way. The page's cutoff is stale at the review date and does not cover mid-2025 to late 2026.
partially supported
1 claimThe cited evidence supports part of the claim but not all of it.
- #3[partially supported][awaiting moderator]in section: Attack method: multisig key compromise
“Both source pages describe the vault's multisig as 'ten-of-ten' while also stating that seven signatures sufficed, an inconsistency the sources do not resolve.”
reviewerBoth source pages describe the multisig as ten-of-ten while stating seven signatures sufficed.Rekt, one of the cited sources, does not give the threshold. Also, 'Both source pages' is internal-process wording that does not belong on a published page. Not checked against Halborn.
confirmed
3 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“approximately $81.5 million in ETH, WBTC, USDT, USDC and DAI”
reviewerExploit took place on December 31, 2023 and drained about $81.5M in ETH, WBTC, USDT, USDC and DAI.Amounts match Rekt News. - #2[confirmed][no action needed]in section: December 31, 2023 exploit
“five unauthorized withdrawals began at approximately 21:08 UTC, with the final USDT transaction completing at approximately 21:25 UTC”
reviewerRekt reports withdrawals began about 21:08 UTC, last at 21:25 UTC, bridge deactivated 22:21 UTC.Matches; Rekt also gives 20:52 UTC as breach time, which is consistent with the alternative account the page cites. - #4[confirmed][no action needed]in section: Alleged insider threat: former CISO
“made unauthorized changes to the company's internal firewall policies on November 22, 2023, two days after submitting a voluntary resignation request, and left the company on December 6, 2023”
reviewerOzys alleges its former CISO changed firewall policies Nov 22, 2023, two days after resigning request, left Dec 6, discovered Jan 10, allegations public Jan 25, 2024.Dates match. The Block gives no explicit lawsuit filing date, but the page ties it to Jan 25 only loosely.