Audit log

Every state-changing event for Payy Network: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-09-25 17:16:45Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 450,417,284

   sig

   2rYdWujVt8Tv…pEmYNCghcopyexplorer ↗

   hash

   94yCTug5onr7…gwsCxAcvcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (13323 B) ▸

   {"actor":"system:backfill","investigation_id":"acfcb1c5-d03f-4e67-ae2f-60e8a37a8d1c","kind":"publish","page_slug":"payy-network","published_at":"2026-09-25T17:16:45.099Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Payy Network","sections":[{"content":"At approximately 04:21 UTC on September 24, 2026, an attacker called the verifyRollup function on Payy Network's Ethereum rollup bridge contract and transferred the contract's entire USDC balance in a single transaction. On-chain data at Ethereum block 26044909 shows approximately 1,832,149.4681 USDC was removed, with the primary receiving address (0xAa4985dBDaBfACa344237D40F7E06C4a0BB57E70) receiving approximately 1,828,589.38 USDC. Three additional smaller recipient addresses received the remaining balance. The transaction hash is reported as 0xf43abdac5422087f645d77923eb1c825178bff3eb86d17d40fa18d89701e1814. Payy Network confirmed the incident via a public post at 14:04 UTC on September 24, 2026, stating: 'Today at 4:21 UTC Payy's bridge contract on Ethereum was exploited and drained of its full balance.' The company noted that its investigation was ongoing and that all network transactions had been paused.","heading":"Bridge Exploit — September 24, 2026","severity":"critical","sources":[{"credibility":2,"name":"Payy bridge exploit freezes crypto cards, and no balances remain safe — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/payy-bridge-exploit-freezes-crypto-cards-and-no-balances-remain-safe/"},{"credibility":2,"name":"$1.83M in USDC Left Payy's Ethereum Rollup, But the Network Has Not Confirmed a Hack — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/09/24/1-83-million-in-usdc-leaves-payy-networks-ethereum-rollup-contract/"},{"credibility":2,"name":"Attackers Siphon About $1.83M in USDC From Payy Rollup Bridge, Freezing Cards and Wallets — Kobaran","type":"news_article","url":"https://www.kobaran.com/attackers-siphon-about-1-83m-in-usdc-from-payy-rollup-bridge-freezing-cards-and-wallets/"},{"credibility":2,"name":"Hackers Exploited Ethereum Bridge Contract to Drain Full Balance from Payy Network — CyberSecurityNews","type":"news_article","url":"https://cybersecuritynews.com/payy-ethereum-bridge-contract-drain/"}]},{"content":"Security firm ExVul alleged in its post-incident analysis that the attacker submitted the malicious withdrawal batch using Payy's own prover key and that it was signed by Payy's own validator key. If accurate, this would indicate a privileged key compromise rather than a publicly exploitable smart-contract bug. Payy has not confirmed or denied ExVul's assessment, has not identified the attacker, and has not publicly disclosed the root cause of the exploit. Whether the compromise stemmed from stolen credentials, an insider incident, a flawed key-management process, or another vector remains unconfirmed as of the time of writing. Security researchers independently noted that the batch structure matched Payy's internal signing workflow.","heading":"Alleged Key Compromise","severity":"critical","sources":[{"credibility":2,"name":"Attackers Siphon About $1.83M in USDC From Payy Rollup Bridge, Freezing Cards and Wallets — Kobaran (citing ExVul)","type":"news_article","url":"https://www.kobaran.com/attackers-siphon-about-1-83m-in-usdc-from-payy-rollup-bridge-freezing-cards-and-wallets/"},{"credibility":2,"name":"Payy Network halts operations after $1.92M USDC exploit drains Ethereum rollup — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/payy-network-halt-usdc-exploit-ethereum-rollup/"}]},{"content":"According to blockchain investigation firm Specter Investigation, the stolen USDC was routed through the Railgun privacy protocol following the exploit. The funds were reportedly converted into approximately 683 ETH and distributed across multiple addresses, materially hampering on-chain traceability. Payy stated it shared attacker-linked addresses with law enforcement agencies, cryptocurrency exchanges, and blockchain analytics firms in an effort to prevent liquidation and further laundering of the stolen assets. No recovery of funds had been publicly confirmed as of the most recent reporting.","heading":"Fund Movement and Tracing","severity":"high","sources":[{"credibility":2,"name":"Attackers Siphon About $1.83M in USDC From Payy Rollup Bridge, Freezing Cards and Wallets — Kobaran","type":"news_article","url":"https://www.kobaran.com/attackers-siphon-about-1-83m-in-usdc-from-payy-rollup-bridge-freezing-cards-and-wallets/"},{"credibility":2,"name":"Payy Network halts operations after $1.92M USDC exploit drains Ethereum rollup — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/payy-network-halt-usdc-exploit-ethereum-rollup/"}]},{"content":"Following the exploit, Payy Network suspended all platform functions, including deposits, withdrawals, transfers, and card payments. Users were unable to access balances or conduct transactions as of September 24, 2026. Payy has not disclosed the number of affected users, whether user funds held on the platform beyond the bridge contract balance are at risk, or what — if any — reimbursement or recovery plan exists. No restoration timeline has been published. The platform stated it was working with law enforcement and cybersecurity professionals but provided no further operational detail.","heading":"Platform Suspension and User Impact","severity":"critical","sources":[{"credibility":2,"name":"Payy bridge exploit freezes crypto cards, and no balances remain safe — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/payy-bridge-exploit-freezes-crypto-cards-and-no-balances-remain-safe/"},{"credibility":2,"name":"Payy Halts Network After $1.83M Ethereum Bridge Exploit Hits — Coin Edition","type":"news_article","url":"https://coinedition.com/crypto-live-news/payy-halts-network-after-1-83m-ethereum-bridge-exploit-hits/"},{"credibility":2,"name":"Payy Halts Network After $1.83M Ethereum Bridge Exploit Hits — Phemex News","type":"news_article","url":"https://phemex.com/news/article/payy-network-halts-all-transactions-after-ethereum-bridge-contract-drained-in-attack-97788"}]},{"content":"In June 2026, Payy Network disclosed a critical vulnerability in its zk-circuit logic — the cryptographic layer responsible for generating the zero-knowledge proofs underpinning the platform's privacy model. The flaw allegedly permitted the potential creation of forged burn messages, meaning an attacker could theoretically signal that tokens had been destroyed when they had not been. Payy reported that the flaw was patched in version 1.3.0 before any funds were lost. It is not publicly confirmed whether the June 2026 circuit vulnerability is related to the September 2026 bridge exploit. No independent audit confirming the patch's sufficiency has been publicly cited.","heading":"Prior Security Disclosure — June 2026 ZK-Circuit Flaw","severity":"medium","sources":[{"credibility":2,"name":"Payy Network halts operations after $1.92M USDC exploit drains Ethereum rollup — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/payy-network-halt-usdc-exploit-ethereum-rollup/"}]},{"content":"As of September 24–25, 2026, Payy Network had not publicly disclosed: the attacker's identity or wallet addresses, a verified transaction hash for the exploit, the technical root cause of the bridge drain, the total scope of potential user losses beyond the bridge contract, a timeline for service restoration, or a compensation plan for affected users. The only official statement confirmed the exploit occurred and that all transactions were paused. This level of disclosure is materially below the standard set by comparable post-exploit responses in the industry. The absence of a post-mortem or preliminary root-cause statement within 24 hours of a full-bridge drain represents a significant transparency gap.","heading":"Transparency and Disclosure Gaps","severity":"high","sources":[{"credibility":2,"name":"$1.83M in USDC Left Payy's Ethereum Rollup, But the Network Has Not Confirmed a Hack — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/09/24/1-83-million-in-usdc-leaves-payy-networks-ethereum-rollup-contract/"},{"credibility":2,"name":"Payy bridge exploit freezes crypto cards, and no balances remain safe — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/payy-bridge-exploit-freezes-crypto-cards-and-no-balances-remain-safe/"}]}],"sources_used":[{"credibility":2,"name":"Payy bridge exploit freezes crypto cards, and no balances remain safe — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/payy-bridge-exploit-freezes-crypto-cards-and-no-balances-remain-safe/"},{"credibility":2,"name":"Hackers Exploited Ethereum Bridge Contract to Drain Full Balance from Payy Network — CyberSecurityNews","type":"news_article","url":"https://cybersecuritynews.com/payy-ethereum-bridge-contract-drain/"},{"credibility":2,"name":"Payy Halts Network After $1.83M Ethereum Bridge Exploit Hits — Phemex News","type":"news_article","url":"https://phemex.com/news/article/payy-network-halts-all-transactions-after-ethereum-bridge-contract-drained-in-attack-97788"},{"credibility":2,"name":"Payy Network halts operations after $1.92M USDC exploit drains Ethereum rollup — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/payy-network-halt-usdc-exploit-ethereum-rollup/"},{"credibility":2,"name":"$1.83M in USDC Left Payy's Ethereum Rollup, But the Network Has Not Confirmed a Hack — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/09/24/1-83-million-in-usdc-leaves-payy-networks-ethereum-rollup-contract/"},{"credibility":2,"name":"Attackers Siphon About $1.83M in USDC From Payy Rollup Bridge, Freezing Cards and Wallets — Kobaran","type":"news_article","url":"https://www.kobaran.com/attackers-siphon-about-1-83m-in-usdc-from-payy-rollup-bridge-freezing-cards-and-wallets/"},{"credibility":2,"name":"Payy Halts Network After $1.83M Ethereum Bridge Exploit Hits — Coin Edition","type":"news_article","url":"https://coinedition.com/crypto-live-news/payy-halts-network-after-1-83m-ethereum-bridge-exploit-hits/"},{"credibility":2,"name":"Attackers Drain Payy Network After Exploiting Ethereum Bridge Contract — GBHackers","type":"news_article","url":"https://gbhackers.com/attackers-drain-payy-network/"}],"summary":"Payy Network is a zk-rollup stablecoin payments and crypto card platform built on Ethereum. On September 24, 2026, its Ethereum L1 rollup bridge contract was fully drained of approximately 1,832,149 USDC (~$1.83M) in a single transaction, prompting the platform to freeze all network, wallet, and card functions. The root cause has not been publicly confirmed by Payy; security firm ExVul alleged the attack batch was submitted using Payy's own prover and validator keys, suggesting a privileged key compromise rather than a public smart-contract bug.","timeline":[{"date":"2026-06-01","event":"Payy Network disclosed a critical vulnerability in its zk-circuit logic allowing potential forged burn messages. The flaw was reportedly patched in version 1.3.0 before exploitation.","source":"Crypto Briefing","source_url":"https://cryptobriefing.com/payy-network-halt-usdc-exploit-ethereum-rollup/"},{"date":"2026-09-24","event":"At 04:21 UTC, an attacker called the verifyRollup function on Payy's Ethereum bridge contract at block 26044909, transferring approximately 1,832,149 USDC (~$1.83M) out of the contract in a single transaction.","source":"CryptoTimes / CryptoSlate","source_url":"https://www.cryptotimes.io/2026/09/24/1-83-million-in-usdc-leaves-payy-networks-ethereum-rollup-contract/"},{"date":"2026-09-24","event":"Stolen USDC was reportedly routed through the Railgun privacy protocol and converted to approximately 683 ETH, then distributed across multiple addresses, per Specter Investigation.","source":"Kobaran (citing Specter Investigation)","source_url":"https://www.kobaran.com/attackers-siphon-about-1-83m-in-usdc-from-payy-rollup-bridge-freezing-cards-and-wallets/"},{"date":"2026-09-24","event":"Payy Network suspended all deposits, withdrawals, transfers, and card payments platform-wide and initiated incident response protocols.","source":"CryptoSlate","source_url":"https://cryptoslate.com/payy-bridge-exploit-freezes-crypto-cards-and-no-balances-remain-safe/"},{"date":"2026-09-24","event":"Payy Network confirmed the exploit publicly at approximately 14:04 UTC, stating: 'Today at 4:21 UTC Payy's bridge contract on Ethereum was exploited and drained of its full balance.' The company announced it had notified law enforcement, exchanges, and blockchain analytics firms.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/09/24/1-83-million-in-usdc-leaves-payy-networks-ethereum-rollup-contract/"},{"date":"2026-09-24","event":"Security firm ExVul alleged the attacker submitted the malicious batch using Payy's own prover key and that it was signed by Payy's own validator key, suggesting a privileged credential compromise.","source":"Kobaran (citing ExVul)","source_url":"https://www.kobaran.com/attackers-siphon-about-1-83m-in-usdc-from-payy-rollup-bridge-freezing-cards-and-wallets/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 06ef9704-29ea-47bf-aace-199fd1ba86bbcopy
2. #2reviewby reviewerreviewer

   2026-10-27 07:08:25Z
   Score: 28 → 28 (no score change)
   The core incident is well supported: the exploit date, amounts, two-transaction pattern, swap to ETH, absence of a key compromise, and the halted network. Errors found: the halt is dated Sept 25 where sources say Sept 24, and the ten-month intervals do not match the page's own dates (about 6.5 months from pin to patch, about 11 months from pin to exploit). The technical root cause and version details rest on a single third-party GitHub issue rather than Payy's own post-mortem. The CVE section probably describes the same issue as the June 2026 disclosure. The user and country counts are unchecked because FinSMEs returned 403.
   anchoranchored

   chain

   ●mainnet-betaslot 461,980,364

   sig

   xgk9pe1At9ai…XnjBkdhKcopyexplorer ↗

   hash

   FLh8FuRLKmwN…dzj63RDycopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1521 B) ▸

   {"actor":"reviewer","artifact_identity":"cbe40b8bac2def812bb619a7d61258c6","blocked_count":1,"decided_at":"2026-10-27T07:08:24.841Z","decision":"review","disputed_pct":0.3636,"findings_hash":"HnJ65M27JNHEFH8RdnDkuJPH5FJWG1E8sS4fmXw3sxLg","investigation_id":"acfcb1c5-d03f-4e67-ae2f-60e8a37a8d1c","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":28,"omissions":{"material":0,"total":1},"page_content_hash":"3724ed08e5333d5ad204eae5358abd0d033a0ff569f96b86bc15c03e01045d69","page_slug":"payy-network","prev_score":28,"reason":"The core incident is well supported: the exploit date, amounts, two-transaction pattern, swap to ETH, absence of a key compromise, and the halted network. Errors found: the halt is dated Sept 25 where sources say Sept 24, and the ten-month intervals do not match the page's own dates (about 6.5 months from pin to patch, about 11 months from pin to exploit). The technical root cause and version details rest on a single third-party GitHub issue rather than Payy's own post-mortem. The CVE section probably describes the same issue as the June 2026 disclosure. The user and country counts are unchecked because FinSMEs returned 403.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":11,"sequence_num":2,"subject_status":"exploited","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ff1d6ca9-6a0a-4c37-a79d-5bebb682d690copy
3. #3review reviseby judgejudge

   2026-10-27 07:08:25Z
   Score: 28 → 26 (-2)
   4 of 11 checkable claims (about 36%) were disputed, which falls in the significant-issues band. The disputes trace to two errors: the halt is dated September 25 where the cited reporting says September 24 (claim_findings[0], [1]), and the 'ten months' intervals do not match the page's own dates, which give about 11 months from pin to exploit and about 6.5 months from pin to patch (claim_findings[2], [3]). The core incident (date, amounts, two-transaction drain, swap to ETH) is confirmed, and the errors are factual slips rather than a wrong core allegation, so the penalty sits at the light end of the band. The technical root-cause detail rests on a single third-party GitHub issue instead of Payy's own post-mortem, and one claim was not checked because the source blocked the reviewer.
   anchoranchored

   chain

   ●mainnet-betaslot 461,980,369

   sig

   pEWWdRvP1M7g…Jj8MyN46copyexplorer ↗

   hash

   FG8P11AmeHtR…1VAzJP8icopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1585 B) ▸

   {"actor":"judge","artifact_identity":"cbe40b8bac2def812bb619a7d61258c6","band_override":null,"blocked_count":1,"decided_at":"2026-10-27T07:08:24.841Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.3636,"investigation_id":"acfcb1c5-d03f-4e67-ae2f-60e8a37a8d1c","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":26,"page_slug":"payy-network","prev_score":28,"reason":"4 of 11 checkable claims (about 36%) were disputed, which falls in the significant-issues band. The disputes trace to two errors: the halt is dated September 25 where the cited reporting says September 24 (claim_findings[0], [1]), and the 'ten months' intervals do not match the page's own dates, which give about 11 months from pin to exploit and about 6.5 months from pin to patch (claim_findings[2], [3]). The core incident (date, amounts, two-transaction drain, swap to ETH) is confirmed, and the errors are factual slips rather than a wrong core allegation, so the penalty sits at the light end of the band. The technical root-cause detail rests on a single third-party GitHub issue instead of Payy's own post-mortem, and one claim was not checked because the source blocked the reviewer.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":-2,"score_limit":{"applied":-2,"limited":true,"proposed":-15,"rule":"limited_no_second_opinion","second":null},"scored_claims":11,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ac2a36fc-b801-430e-afbc-90ed45827068copy
4. #4rescoreby systemsystem

   2026-11-02 14:46:12Z
   Score: 26 → 45 (+19)
   Re-read and rescored after the page was re-researched (2026-11-02). Rescored under Scoring v2, the published formula (avoid.net/scoring): 26 → 45. Problems weighed by who is responsible: incidents the subject suffered −10, concerns that are not fraud −6, problems around the subject, caused by others −1.8; a recent unresolved incident −11.7.
   anchoranchored

   chain

   ●mainnet-betaslot 464,534,012

   sig

   44Rgj7S9ytdp…HH6BaaeMcopyexplorer ↗

   hash

   3PbpowEWuv8D…hzGBGC9rcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (709 B) ▸

   {"actor":"system","decided_at":"2026-11-02T14:46:11.732Z","decision":"rescore","investigation_id":"acfcb1c5-d03f-4e67-ae2f-60e8a37a8d1c","new_score":45,"page_slug":"payy-network","prev_score":26,"reason":"Re-read and rescored after the page was re-researched (2026-11-02). Rescored under Scoring v2, the published formula (avoid.net/scoring): 26 → 45. Problems weighed by who is responsible: incidents the subject suffered −10, concerns that are not fraud −6, problems around the subject, caused by others −1.8; a recent unresolved incident −11.7.","score_delta":19,"score_model":"v2","sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision a1e0d7cd-85a1-4382-96a3-7ea88855b977copy
5. #5reviewby reviewerreviewer

   2026-11-02 14:47:45Z
   Score: 45 → 45 (no score change)
   Incident facts (date, amounts, two transactions, halt, root-cause denial of key compromise) and funding facts are well supported. The page's central framing of a 'long-unmaintained' or long-pinned proving dependency is not supported: the advisory's Barretenberg version is the reporter's test build, and the flaw is in Payy's own circuit. The page also omits that CryptoBriefing says the advisory flaw was patched before the drain. The UniswapX/Railgun attribution of the 683 ETH figure looks misassigned. The claims-process section conflicts with search results and was not verified.
   anchoranchored

   chain

   ●mainnet-betaslot 464,534,460

   sig

   3unymwDJCMBV…C7sp3Sgicopyexplorer ↗

   hash

   F2ZsfHdk44Nq…F9LZa7tJcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1473 B) ▸

   {"actor":"reviewer","artifact_identity":"9eae0d2f289db34d3f2d88a44c54121d","blocked_count":1,"decided_at":"2026-11-02T14:47:45.763Z","decision":"review","disputed_pct":0.3333,"findings_hash":"39tsjkUGjGKPEicWSo7DjD87qDsow2b9M2fUQ1S5vCEv","investigation_id":"acfcb1c5-d03f-4e67-ae2f-60e8a37a8d1c","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":45,"omissions":{"material":1,"total":2},"page_content_hash":"7ca8dcd80ff0ee2af8828e5d693d10d33495294cb3e180a75782c9f1b957b47c","page_slug":"payy-network","prev_score":45,"reason":"Incident facts (date, amounts, two transactions, halt, root-cause denial of key compromise) and funding facts are well supported. The page's central framing of a 'long-unmaintained' or long-pinned proving dependency is not supported: the advisory's Barretenberg version is the reporter's test build, and the flaw is in Payy's own circuit. The page also omits that CryptoBriefing says the advisory flaw was patched before the drain. The UniswapX/Railgun attribution of the 683 ETH figure looks misassigned. The claims-process section conflicts with search results and was not verified.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":12,"sequence_num":5,"subject_status":"exploited","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 51ee6354-1335-4258-bbec-5f6da0053307copy
6. #6review reviseby judgejudge

   2026-11-02 14:47:46Z
   Score: 45 → 45 (no score change)
   Of 12 countable claims (one blocked-source claim excluded), 3 were disputed and 1 could not be found in any source, giving about 33%, which falls in the significant-issues band. The disputed claims (claim_findings[5], [6], [7]) all concern the page's framing that Payy relied on a long-unmaintained proving dependency. Tier 1 advisory evidence shows only the reporter's test build and a flaw in Payy's own circuit. The page also omits a material point: CryptoBriefing reports the advisory flaw was patched before the drain. The incident facts (amounts, date, halt, funding) are well supported, the claims-process section could not be checked against a source, and reviewer confidence is moderate, so the penalty sits mid-band and the page is not denied.
   anchoranchored

   chain

   ●mainnet-betaslot 464,534,465

   sig

   2KU76Rwcbfgw…YHPumkaccopyexplorer ↗

   hash

   Edo5NNTzpkh4…23To7SdVcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1864 B) ▸

   {"actor":"judge","artifact_identity":"9eae0d2f289db34d3f2d88a44c54121d","band_override":null,"blocked_count":1,"decided_at":"2026-11-02T14:47:45.763Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.3333,"investigation_id":"acfcb1c5-d03f-4e67-ae2f-60e8a37a8d1c","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":45,"page_slug":"payy-network","prev_score":45,"reason":"Of 12 countable claims (one blocked-source claim excluded), 3 were disputed and 1 could not be found in any source, giving about 33%, which falls in the significant-issues band. The disputed claims (claim_findings[5], [6], [7]) all concern the page's framing that Payy relied on a long-unmaintained proving dependency. Tier 1 advisory evidence shows only the reporter's test build and a flaw in Payy's own circuit. The page also omits a material point: CryptoBriefing reports the advisory flaw was patched before the drain. The incident facts (amounts, date, halt, funding) are well supported, the claims-process section could not be checked against a source, and reviewer confidence is moderate, so the penalty sits mid-band and the page is not denied.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":12,"sequence_num":6,"severity_override":{"applied":true,"band":"significant","from_band":"significant","reason":"The review reports a material omission: CryptoBriefing says the June 2026 advisory flaw was patched in v1.3.0 before any funds were lost, and the page does not say so. This bears directly on the page's central causal framing. The percentage band is already significant, so the omission confirms that band and rules out a milder one."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 9f840c56-9eab-4af6-9bca-9fd42423f80acopy
7. #7acceptby agent:avoid-moderatoranalyzer

   2026-11-03 22:35:29Z
   Score: 45 → 44 (-1)
   Unchained confirms Payy's Ethereum bridge lost about $1.92M USDC on 24 Sept 2026, network and wallet paused, and Payy's initial analysis ruled out key compromise, social engineering and off-chain exploit.
   Source:https://unchainedcrypto.com/payy-rules-out-a-compromised-key-in-1-92-million-drain-of-users-deposits/

   Wayback:archived snapshot2026-10-09 18:24:02Z
   anchoranchored

   chain

   ●mainnet-betaslot 465,068,679

   sig

   4JibbG7TKRvP…MX2vpatCcopyexplorer ↗

   hash

   AujaGbLmTZEc…SHURv9zncopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (674 B) ▸

   {"actor":"agent:avoid-moderator","decided_at":"2026-11-03T22:35:29.605Z","decision":"accept","investigation_id":"acfcb1c5-d03f-4e67-ae2f-60e8a37a8d1c","new_score":44,"page_slug":"payy-network","prev_score":45,"reason":"Unchained confirms Payy's Ethereum bridge lost about $1.92M USDC on 24 Sept 2026, network and wallet paused, and Payy's initial analysis ruled out key compromise, social engineering and off-chain exploit.","score_delta":-1,"sequence_num":7,"submission_content_hash":"7a679dea24c7a60e9158a4f0a65cc2bcdbcba4ef708e387e9c8577ff549b5336","submission_id":"c99ad553-2666-4105-8468-e4623531914e","submission_kind":"url","submission_valence":"incriminating","v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision f71318fb-32d3-4f6d-9a0a-737c7c676e6dcopy
8. #8acceptby agent:avoid-moderatoranalyzer

   2026-11-03 23:14:54Z
   Score: 44 → 42 (-2)
   The Defiant headline and subtitle report a $1.92M USDC drain from Payy and paused deposits, withdrawals and card payments, as the note says.
   Source:https://thedefiant.io/news/hacks/payy-halts-network-after-1-92-million-usdc-drain

   Wayback:failed
   anchoranchored

   chain

   ●mainnet-betaslot 465,080,005

   sig

   3GLFkqvcCEhe…N7uHVb2acopyexplorer ↗

   hash

   8zVX6oZQohtZ…myrS3zjicopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (610 B) ▸

   {"actor":"agent:avoid-moderator","decided_at":"2026-11-03T23:14:54.277Z","decision":"accept","investigation_id":"acfcb1c5-d03f-4e67-ae2f-60e8a37a8d1c","new_score":42,"page_slug":"payy-network","prev_score":44,"reason":"The Defiant headline and subtitle report a $1.92M USDC drain from Payy and paused deposits, withdrawals and card payments, as the note says.","score_delta":-2,"sequence_num":8,"submission_content_hash":"3cf9fd3f193bdc7542a8d2d39aa817b0ed7b49c3bea122f35574b7914c1c46a4","submission_id":"fe83a38f-45f5-43a0-9a85-104a098cb583","submission_kind":"url","submission_valence":"incriminating","v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision b6ac2432-9525-4dad-899b-6a77abe666c0copy
9. #9rescoreby systemsystem

   2026-11-04 00:47:55Z
   Score: 42 → 32 (-10)
   Re-read and rescored after the page was re-researched (2026-11-04). Rescored under Scoring v2, the published formula (avoid.net/scoring): 42 → 32. Problems weighed by who is responsible: incidents the subject suffered −16, problems around the subject, caused by others −1.5; a recent unresolved incident −18.8; accepted community evidence −3.4.
   anchoranchored

   chain

   ●mainnet-betaslot 465,105,871

   sig

   29nk25KnVuKn…SXPHLoXCcopyexplorer ↗

   hash

   DAyFi4777s9x…8JpAwuEPcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (712 B) ▸

   {"actor":"system","decided_at":"2026-11-04T00:47:54.785Z","decision":"rescore","investigation_id":"acfcb1c5-d03f-4e67-ae2f-60e8a37a8d1c","new_score":32,"page_slug":"payy-network","prev_score":42,"reason":"Re-read and rescored after the page was re-researched (2026-11-04). Rescored under Scoring v2, the published formula (avoid.net/scoring): 42 → 32. Problems weighed by who is responsible: incidents the subject suffered −16, problems around the subject, caused by others −1.5; a recent unresolved incident −18.8; accepted community evidence −3.4.","score_delta":-10,"score_model":"v2","sequence_num":9,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision aa050183-ecf8-4ed7-b17e-e526b72301e7copy
10. #10reviewby reviewerreviewer

    2026-11-04 00:49:00Z
    Score: 32 → 32 (no score change)
    All checked claims match their cited sources, including the figures, timings, CVE details and secondhand claims reporting. The page hedges well on the unconfirmed cause and the secondary status of the compensation reporting. It lacks primary-source Payy statements, on-chain detail and background on the company.
    anchoranchored

    chain

    ●mainnet-betaslot 465,106,160

    sig

    3nFhTFPGRkyj…duhsoUudcopyexplorer ↗

    hash

    HqnGRKccNapz…Tg8Y7FX2copysha256 → base58

    verifying row…full verify ↗

    canonical bytes (1159 B) ▸

    {"actor":"reviewer","artifact_identity":"7d064a1627a51fe9cc93d789c65a6919","decided_at":"2026-11-04T00:49:00.608Z","decision":"review","disputed_pct":0,"findings_hash":"Cuarx1ezWBrmb1RWVDDPcF1syoVxDJcbqdQ6B7XMysu","investigation_id":"acfcb1c5-d03f-4e67-ae2f-60e8a37a8d1c","judge_def_hash":"750934ecb48272224909b7430fab271676d391380fbc821acbe7ee7e4cac2fa3","new_score":32,"omissions":{"material":0,"total":1},"page_content_hash":"979c30f50a694f6b42d2c5adc2cfee002b2f8b2aae3054295c7d8d2e88a8005c","page_slug":"payy-network","prev_score":32,"reason":"All checked claims match their cited sources, including the figures, timings, CVE details and secondhand claims reporting. The page hedges well on the unconfirmed cause and the secondary status of the compensation reporting. It lacks primary-source Payy statements, on-chain detail and background on the company.","reviewer_def_hash":"3839668b232611e5b26db72079d64745f8e57e919b8a379e79b44ba4a52c845b","score_delta":0,"sequence_num":10,"subject_status":"shut_down","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

    Verify offline (run on your own machine)

    python -m src.verify_decision 13f7dcc0-856e-469a-b2be-a874c1099288copy
11. #11review approveby judgejudge

    2026-11-04 00:49:00Z
    Score: 32 → 32 (no score change)
    All 8 checked claims (claim_findings[0-7]) were confirmed against their cited sources, including the drain figures and timing, the CVE-2026-48100 details from a Tier 1 record, and the secondhand claims-process reporting, so disputed_pct is 0%. The page already says the cause is unconfirmed and that the compensation reporting is secondary. The wallet-closure omission is minor and covered in the body, and the reported shutdown status matches the page. The high-priority gap, that Payy's own post-mortem is missing, suggests expansion rather than correction, because the page labels those points as secondhand.
    anchoranchored

    chain

    ●mainnet-betaslot 465,106,165

    sig

    3KYvJz2q8Kna…1szjEv4Xcopyexplorer ↗

    hash

    GGha8dtGDUFN…1CHCdqYhcopysha256 → base58

    verifying row…full verify ↗

    canonical bytes (1254 B) ▸

    {"actor":"judge","artifact_identity":"7d064a1627a51fe9cc93d789c65a6919","band_override":null,"decided_at":"2026-11-04T00:49:00.608Z","decision":"review_approve","delist_requested":false,"disputed_pct":0,"investigation_id":"acfcb1c5-d03f-4e67-ae2f-60e8a37a8d1c","judge_def_hash":"750934ecb48272224909b7430fab271676d391380fbc821acbe7ee7e4cac2fa3","new_score":32,"page_slug":"payy-network","prev_score":32,"reason":"All 8 checked claims (claim_findings[0-7]) were confirmed against their cited sources, including the drain figures and timing, the CVE-2026-48100 details from a Tier 1 record, and the secondhand claims-process reporting, so disputed_pct is 0%. The page already says the cause is unconfirmed and that the compensation reporting is secondary. The wallet-closure omission is minor and covered in the body, and the reported shutdown status matches the page. The high-priority gap, that Payy's own post-mortem is missing, suggests expansion rather than correction, because the page labels those points as secondhand.","reviewer_def_hash":"3839668b232611e5b26db72079d64745f8e57e919b8a379e79b44ba4a52c845b","score_delta":0,"sequence_num":11,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

    Verify offline (run on your own machine)

    python -m src.verify_decision 255b159b-2176-495b-967a-0a278294dfe7copy