Audit log

Every state-changing event for Phemex: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-20 04:09:26Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 420,910,776

   sig

   LDBroZ4c1Zvi…qzN5yNWWcopyexplorer ↗

   hash

   6RuCqVmWpUcc…z6Qtq5Vncopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6569 B) ▸

   {"actor":"system:backfill","investigation_id":"527f7443-54de-424a-ba23-7009e2197dd7","kind":"publish","page_slug":"phemex","published_at":"2026-05-20T04:09:26.341Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Phemex","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/from-morgan-stanley-to-crypto-world-in-a-conversation-with-phemex-founder"},{"credibility":3,"name":"","type":"other","url":"https://en.everybodywiki.com/Phemex"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-phemex-hack-january-2025"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/342265/millions-worth-stolen-funds-phemex-hack-move-tornado-cash-crypto-mixer"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/lazarus-group-consolidates-bybit-phemex-hacker-wallet"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2025/01/23/crypto-exchange-phemex-investigating-hack-reports-as-usd29m-drained-from-hot-wallets"},{"credibility":3,"name":"","type":"other","url":"https://x.com/zachxbt/status/1893211577836302365"},{"credibility":3,"name":"","type":"other","url":"https://beincrypto.com/phemex-hack-hot-wallets-exploit/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.merklescience.com/blog/hack-track-phemex-flow-of-funds-analysis"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/342265/millions-worth-stolen-funds-phemex-hack-move-tornado-cash-crypto-mixer"},{"credibility":3,"name":"","type":"other","url":"https://x.com/zachxbt/status/1893211577836302365"},{"credibility":3,"name":"","type":"other","url":"https://www.ainvest.com/news/crypto-hacks-surge-phemex-breach-tops-69m-2501101063ec4bcbbd767285/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.capitalmarketstribunal.ca/en/proceedings/decisions-in-brief/decision-brief-phemex-limited-enforcement-proceeding-merits-december-18-2024"},{"credibility":3,"name":"","type":"other","url":"https://www.osc.ca/en/news-events/news/osc-continues-hold-non-compliant-crypto-asset-trading-platforms-accountable"},{"credibility":3,"name":"","type":"other","url":"https://fintelegram.com/attention-regulatory-enforcement-proceedings-against-crypto-exchange-phemex/"},{"credibility":3,"name":"","type":"other","url":"https://www.bitget.com/amp/academy/phemex-us-legal"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://cryptoslate.com/phemex-reassures-users-with-a-compensation-plan-after-37-million-hot-wallet-breach/"},{"credibility":3,"name":"","type":"other","url":"https://phemex.com/announcements/phemex-hot-wallet-security-incident-update-and-timeline"},{"credibility":3,"name":"","type":"other","url":"https://www.cryptotimes.io/2025/01/23/phemex-exchange-hacked-29m-stolen-withdrawals-suspended/"},{"credibility":3,"name":"","type":"other","url":"https://www.capitalmarketstribunal.ca/en/proceedings/decisions-in-brief/decision-brief-phemex-limited-enforcement-proceeding-merits-december-18-2024"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-phemex-hack-january-2025"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/lazarus-group-consolidates-bybit-phemex-hacker-wallet"},{"credibility":3,"name":"","type":"other","url":"https://www.capitalmarketstribunal.ca/en/proceedings/decisions-in-brief/decision-brief-phemex-limited-enforcement-proceeding-merits-december-18-2024"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/342265/millions-worth-stolen-funds-phemex-hack-move-tornado-cash-crypto-mixer"}]}],"sources_used":[],"summary":"Phemex is a centralized cryptocurrency derivatives exchange founded in November 2019 by former Morgan Stanley executives and registered in the British Virgin Islands. In January 2025, the exchange suffered one of the largest crypto hacks of that year, with an estimated $69–85 million drained from hot wallets across 16 blockchains, subsequently attributed to North Korea's Lazarus Group through on-chain evidence linking the same wallets to the February 2025 Bybit hack. Phemex has also faced formal regulatory enforcement actions in Ontario, Canada, and operates without authorization in the United Kingdom.","timeline":[{"date":"2019-11-01","event":"Phemex founded by Jack Tao and seven other former Morgan Stanley executives; incorporated in the British Virgin Islands.","source":""},{"date":"2021-01-01","event":"UK Financial Conduct Authority designates Phemex as an unauthorized firm operating without FCA approval.","source":""},{"date":"2023-01-07","event":"Phemex implements IP-based blocks on Ontario users after being contacted by the Ontario Securities Commission.","source":""},{"date":"2024-12-18","event":"Ontario Capital Markets Tribunal rules in Phemex Limited (Re), 2024 ONCMT 30 that Phemex operated an unregistered securities trading platform in Ontario; both entities permanently banned from Ontario capital markets.","source":""},{"date":"2025-01-23","event":"Phemex hot wallets drained across 16 blockchains; estimated $69–85 million stolen. Withdrawals suspended at 15:13 UTC. PeckShield and Cyvers flag approximately 125 suspicious transactions.","source":""},{"date":"2025-01-24","event":"Phemex CEO publishes Proof of Reserves and issues compensation plan. Security firms Halborn, Merkle Science, and Hacken begin on-chain analysis; Lazarus Group suspected.","source":""},{"date":"2025-02-01","event":"Phemex restores full withdrawal services approximately 10 days after the breach.","source":""},{"date":"2025-02-19","event":"Global Ledger identifies 2,080+ ETH from Phemex hack routed through Tornado Cash, eXch mixer, THORChain, and Wintermute.","source":""},{"date":"2025-02-21","event":"Bybit suffers $1.4 billion hack, subsequently attributed to Lazarus Group.","source":""},{"date":"2025-02-22","event":"ZachXBT publicly identifies on-chain commingling of Phemex and Bybit hack proceeds at Ethereum address 0x33d057af74779925c4b2e720a820387cb89f8f65, directly linking both hacks to Lazarus Group.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d15249db-d3cc-4142-9c4c-a3e74197310bcopy
2. #2rescoreby systemsystem

   2026-10-10 18:48:44Z
   Score: 10 → 58 (+48)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 58. Problems weighed by who is responsible: incidents the subject suffered −9.6, concerns that are not fraud −6.4, problems around the subject, caused by others −0.8; legitimacy credit long-running +10.
   anchoranchored

   chain

   ●mainnet-betaslot 455,368,620

   sig

   34aQKNCbQiwZ…DznoVFwscopyexplorer ↗

   hash

   BtdxhEQmW2XH…GTTBCPGfcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (638 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:48:44.647Z","decision":"rescore","investigation_id":"527f7443-54de-424a-ba23-7009e2197dd7","new_score":58,"page_slug":"phemex","prev_score":10,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 58. Problems weighed by who is responsible: incidents the subject suffered −9.6, concerns that are not fraud −6.4, problems around the subject, caused by others −0.8; legitimacy credit long-running +10.","score_delta":48,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision fb03371f-0cff-41e8-b57f-1d116a022e7dcopy
3. #3acceptby agent:avoid-moderatoranalyzer

   2026-10-16 04:26:17Z
   Score: 58 → 57 (-1)
   CryptoTimes article confirms Phemex suspended withdrawals after a hot-wallet breach, with a $29M headline figure and a conflicting ~$31M figure cited from Lookonchain in the body, exactly as the submission describes.
   Source:https://www.cryptotimes.io/2025/01/23/phemex-exchange-hacked-29m-stolen-withdrawals-suspended/

   Wayback:archived snapshot2026-09-21 15:21:23Z
   anchoranchored

   chain

   ●mainnet-betaslot 457,503,354

   sig

   5cUpd94nWcG8…bj7eGHgDcopyexplorer ↗

   hash

   7Eq7B127VgJZ…VH64NXQfcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (680 B) ▸

   {"actor":"agent:avoid-moderator","decided_at":"2026-10-16T04:26:16.898Z","decision":"accept","investigation_id":"527f7443-54de-424a-ba23-7009e2197dd7","new_score":57,"page_slug":"phemex","prev_score":58,"reason":"CryptoTimes article confirms Phemex suspended withdrawals after a hot-wallet breach, with a $29M headline figure and a conflicting ~$31M figure cited from Lookonchain in the body, exactly as the submission describes.","score_delta":-1,"sequence_num":3,"submission_content_hash":"3bc1f4beddbbd956fc54529e12f56bb6c8af45b9ed616a144c41a91b0803aa8c","submission_id":"a4def7c1-193c-4a88-b52a-6d6cefdc6506","submission_kind":"url","submission_valence":"incriminating","v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision eb706f0a-dec3-497a-803b-3fea6a514baccopy
4. #4acceptby agent:avoid-moderatoranalyzer

   2026-10-16 05:26:08Z
   Score: 57 → 55 (-2)
   BleepingComputer confirms Phemex detected a hot-wallet breach on Jan 23, 2025, with losses revised to over $85M, and that attackers were unidentified at time of report. Matches the submission exactly.
   Source:https://www.bleepingcomputer.com/news/security/hackers-steal-85-million-worth-of-cryptocurrency-from-phemex/

   Wayback:archived snapshot2026-09-21 05:40:53Z
   anchoranchored

   chain

   ●mainnet-betaslot 457,519,988

   sig

   D8LNm9hND4kF…moRq2xGwcopyexplorer ↗

   hash

   84wEYy5BA1K7…6Cqppyb9copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (664 B) ▸

   {"actor":"agent:avoid-moderator","decided_at":"2026-10-16T05:26:08.440Z","decision":"accept","investigation_id":"527f7443-54de-424a-ba23-7009e2197dd7","new_score":55,"page_slug":"phemex","prev_score":57,"reason":"BleepingComputer confirms Phemex detected a hot-wallet breach on Jan 23, 2025, with losses revised to over $85M, and that attackers were unidentified at time of report. Matches the submission exactly.","score_delta":-2,"sequence_num":4,"submission_content_hash":"72313048c0740d6dc42a3b6ac88a6fb30844f964154ea9870291b8ad27e96fcd","submission_id":"5cd4765a-5d58-4842-8ce8-558bba94bccc","submission_kind":"url","submission_valence":"incriminating","v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 34771488-a06a-47e4-9fd9-49dae2a80c07copy