Audit log

Every state-changing event for Phemex: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.

1. #1publishby system:backfill

   2026-05-20 04:09:26Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 420,910,776

   sig

   LDBroZ4c1Zvi…qzN5yNWWcopyexplorer ↗

   hash

   6RuCqVmWpUcc…z6Qtq5Vncopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6569 B) ▸

   {"actor":"system:backfill","investigation_id":"527f7443-54de-424a-ba23-7009e2197dd7","kind":"publish","page_slug":"phemex","published_at":"2026-05-20T04:09:26.341Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Phemex","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/from-morgan-stanley-to-crypto-world-in-a-conversation-with-phemex-founder"},{"credibility":3,"name":"","type":"other","url":"https://en.everybodywiki.com/Phemex"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-phemex-hack-january-2025"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/342265/millions-worth-stolen-funds-phemex-hack-move-tornado-cash-crypto-mixer"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/lazarus-group-consolidates-bybit-phemex-hacker-wallet"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2025/01/23/crypto-exchange-phemex-investigating-hack-reports-as-usd29m-drained-from-hot-wallets"},{"credibility":3,"name":"","type":"other","url":"https://x.com/zachxbt/status/1893211577836302365"},{"credibility":3,"name":"","type":"other","url":"https://beincrypto.com/phemex-hack-hot-wallets-exploit/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.merklescience.com/blog/hack-track-phemex-flow-of-funds-analysis"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/342265/millions-worth-stolen-funds-phemex-hack-move-tornado-cash-crypto-mixer"},{"credibility":3,"name":"","type":"other","url":"https://x.com/zachxbt/status/1893211577836302365"},{"credibility":3,"name":"","type":"other","url":"https://www.ainvest.com/news/crypto-hacks-surge-phemex-breach-tops-69m-2501101063ec4bcbbd767285/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.capitalmarketstribunal.ca/en/proceedings/decisions-in-brief/decision-brief-phemex-limited-enforcement-proceeding-merits-december-18-2024"},{"credibility":3,"name":"","type":"other","url":"https://www.osc.ca/en/news-events/news/osc-continues-hold-non-compliant-crypto-asset-trading-platforms-accountable"},{"credibility":3,"name":"","type":"other","url":"https://fintelegram.com/attention-regulatory-enforcement-proceedings-against-crypto-exchange-phemex/"},{"credibility":3,"name":"","type":"other","url":"https://www.bitget.com/amp/academy/phemex-us-legal"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://cryptoslate.com/phemex-reassures-users-with-a-compensation-plan-after-37-million-hot-wallet-breach/"},{"credibility":3,"name":"","type":"other","url":"https://phemex.com/announcements/phemex-hot-wallet-security-incident-update-and-timeline"},{"credibility":3,"name":"","type":"other","url":"https://www.cryptotimes.io/2025/01/23/phemex-exchange-hacked-29m-stolen-withdrawals-suspended/"},{"credibility":3,"name":"","type":"other","url":"https://www.capitalmarketstribunal.ca/en/proceedings/decisions-in-brief/decision-brief-phemex-limited-enforcement-proceeding-merits-december-18-2024"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-phemex-hack-january-2025"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/lazarus-group-consolidates-bybit-phemex-hacker-wallet"},{"credibility":3,"name":"","type":"other","url":"https://www.capitalmarketstribunal.ca/en/proceedings/decisions-in-brief/decision-brief-phemex-limited-enforcement-proceeding-merits-december-18-2024"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/342265/millions-worth-stolen-funds-phemex-hack-move-tornado-cash-crypto-mixer"}]}],"sources_used":[],"summary":"Phemex is a centralized cryptocurrency derivatives exchange founded in November 2019 by former Morgan Stanley executives and registered in the British Virgin Islands. In January 2025, the exchange suffered one of the largest crypto hacks of that year, with an estimated $69–85 million drained from hot wallets across 16 blockchains, subsequently attributed to North Korea's Lazarus Group through on-chain evidence linking the same wallets to the February 2025 Bybit hack. Phemex has also faced formal regulatory enforcement actions in Ontario, Canada, and operates without authorization in the United Kingdom.","timeline":[{"date":"2019-11-01","event":"Phemex founded by Jack Tao and seven other former Morgan Stanley executives; incorporated in the British Virgin Islands.","source":""},{"date":"2021-01-01","event":"UK Financial Conduct Authority designates Phemex as an unauthorized firm operating without FCA approval.","source":""},{"date":"2023-01-07","event":"Phemex implements IP-based blocks on Ontario users after being contacted by the Ontario Securities Commission.","source":""},{"date":"2024-12-18","event":"Ontario Capital Markets Tribunal rules in Phemex Limited (Re), 2024 ONCMT 30 that Phemex operated an unregistered securities trading platform in Ontario; both entities permanently banned from Ontario capital markets.","source":""},{"date":"2025-01-23","event":"Phemex hot wallets drained across 16 blockchains; estimated $69–85 million stolen. Withdrawals suspended at 15:13 UTC. PeckShield and Cyvers flag approximately 125 suspicious transactions.","source":""},{"date":"2025-01-24","event":"Phemex CEO publishes Proof of Reserves and issues compensation plan. Security firms Halborn, Merkle Science, and Hacken begin on-chain analysis; Lazarus Group suspected.","source":""},{"date":"2025-02-01","event":"Phemex restores full withdrawal services approximately 10 days after the breach.","source":""},{"date":"2025-02-19","event":"Global Ledger identifies 2,080+ ETH from Phemex hack routed through Tornado Cash, eXch mixer, THORChain, and Wintermute.","source":""},{"date":"2025-02-21","event":"Bybit suffers $1.4 billion hack, subsequently attributed to Lazarus Group.","source":""},{"date":"2025-02-22","event":"ZachXBT publicly identifies on-chain commingling of Phemex and Bybit hack proceeds at Ethereum address 0x33d057af74779925c4b2e720a820387cb89f8f65, directly linking both hacks to Lazarus Group.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d15249db-d3cc-4142-9c4c-a3e74197310bcopy