Audit log

Every state-changing event for Purrlend: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-26 18:37:04Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,339,820

   sig

   3ZsK3mhXwPGm…oYmLVU2ucopyexplorer ↗

   hash

   DCqhBViQXnyp…M7kiuXg4copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (4641 B) ▸

   {"actor":"system:backfill","investigation_id":"39910c40-bf09-4d18-b078-4b9b70b813a6","kind":"publish","page_slug":"purrlend","published_at":"2026-05-26T18:37:04.069Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Purrlend","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://ourcryptotalk.com/news/purrlend-defi-protocol-loses-1-5m-multisig-exploit","type":"other","url":""},{"credibility":3,"name":"https://www.mexc.com/news/1053473","type":"other","url":""},{"credibility":3,"name":"https://www.livebitcoinnews.com/purrlend-exploit-steals-1-5m-on-hyperevm-and-megaeth/","type":"other","url":""},{"credibility":3,"name":"https://cryptobriefing.com/defi-attack-impact-purrlend-drained/","type":"other","url":""},{"credibility":3,"name":"https://www.mexc.com/news/1053509","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://ourcryptotalk.com/news/purrlend-defi-protocol-loses-1-5m-multisig-exploit","type":"other","url":""},{"credibility":3,"name":"https://www.ainvest.com/news/purrlend-exploit-1-5m-drain-l2s-part-800m-april-defi-bloodbath-2604/","type":"other","url":""},{"credibility":3,"name":"https://purrlends.gitbook.io/purrlend","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://ourcryptotalk.com/news/purrlend-defi-protocol-loses-1-5m-multisig-exploit","type":"other","url":""},{"credibility":3,"name":"https://www.mexc.com/news/1053473","type":"other","url":""},{"credibility":3,"name":"https://cryptobriefing.com/defi-attack-impact-purrlend-drained/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://purrlends.gitbook.io/purrlend","type":"other","url":""},{"credibility":3,"name":"https://intellectia.ai/news/crypto/purrlend-pauses-protocol-amid-152m-hack-investigation","type":"other","url":""},{"credibility":3,"name":"https://finance.yahoo.com/markets/crypto/articles/another-defi-platform-just-got-122925586.html","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://startupfortune.com/purrlends-15-million-exploit-is-a-small-number-in-april-2026s-catastrophic-defi-security-ledger/","type":"other","url":""},{"credibility":3,"name":"https://www.ainvest.com/news/purrlend-exploit-1-5m-drain-l2s-part-800m-april-defi-bloodbath-2604/","type":"other","url":""},{"credibility":3,"name":"https://www.bitget.com/news/detail/12560605385020","type":"other","url":""}]}],"sources_used":[],"summary":"Purrlend is a non-custodial DeFi lending and borrowing protocol deployed on HyperEVM and MegaETH, operating as an Aave-style fork designed for leveraged yield farming. On April 25, 2026, the protocol suffered a multisig permission exploit that drained approximately $1.52 million across both networks, collapsing its TVL by roughly 70%. As of late May 2026, the protocol remains paused with no published post-mortem, recovery plan, or user compensation details.","timeline":[{"date":"2025-02-01","event":"HyperEVM mainnet launches, enabling new DeFi deployments on Hyperliquid's EVM layer.","source":""},{"date":"2026-04-25","event":"At approximately 1:20 a.m. UTC, Purrlend's 2-of-3 admin multisig executes a suspicious transaction granting an unknown address the 'bridge' role with elevated permissions inherited from the underlying Aave-style implementation.","source":""},{"date":"2026-04-25","event":"Hours after the suspicious role assignment, the attacker uses the granted bridge privileges to mint unbacked tokens and drain liquidity pools across HyperEVM and MegaETH, stealing approximately $1.52 million.","source":""},{"date":"2026-04-25","event":"At approximately 9:10 a.m. UTC, Purrlend pauses all protocol operations and posts a brief statement on X: 'We have detected irregular activity on the protocol and are actively investigating.'","source":""},{"date":"2026-04-25","event":"Kirby Ong, founder of HypurrCollective, first publicly flags the exploit and documents attacker wallet addresses on both HyperEVM and MegaETH block explorers.","source":""},{"date":"2026-04-25","event":"Protocol TVL collapses from approximately $1.5 million to $444,000 as depositor flight follows news of the exploit.","source":""},{"date":"2026-05-26","event":"As of this investigation date, the Purrlend protocol remains paused. No post-mortem, user compensation plan, or recovery details have been published. The exploiting address has not been publicly attributed.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 101309af-f9c3-4d95-95f3-c7fff3af2b3fcopy
2. #2rescoreby systemsystem

   2026-10-10 18:40:18Z
   Score: 22 → 49 (+27)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 22 → 49. Problems weighed by who is responsible: the subject's own conduct −8, concerns that are not fraud −6.4, incidents the subject suffered −3.2, problems around the subject, caused by others −0.8; legitimacy credit long-running +2.
   anchoranchored

   chain

   ●mainnet-betaslot 455,358,624

   sig

   5cGGxpMgC92K…KrSHgMFHcopyexplorer ↗

   hash

   Crz1MjmTXASS…8UVdnyATcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (669 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:40:18.231Z","decision":"rescore","investigation_id":"39910c40-bf09-4d18-b078-4b9b70b813a6","new_score":49,"page_slug":"purrlend","prev_score":22,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 22 → 49. Problems weighed by who is responsible: the subject's own conduct −8, concerns that are not fraud −6.4, incidents the subject suffered −3.2, problems around the subject, caused by others −0.8; legitimacy credit long-running +2.","score_delta":27,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision e8d1967b-e2b2-4d54-8144-e354107e2844copy
3. #3reviewby reviewerreviewer

   2026-11-02 03:49:44Z
   Score: 49 → 49 (no score change)
   Core facts (April 25, 2026 exploit, about $1.52M loss, 2-of-3 multisig without timelock, bridge role, Kirby Ong flag, TVL drop) hold up against the fetched sources. Weaker points are the exact 1:20 a.m. UTC time, the 9:10 UTC pause time (possibly conflated with a publication timestamp), the unsourced 'inside job' community allegation, and the MegaETH figure, which sources disagree on ($324,549 vs about $163K). The status as of late May 2026 is stale and I could not establish the current status.
   anchoranchored

   chain

   ●mainnet-betaslot 464,350,132

   sig

   2MfG67qKkZMC…zoQFx5tFcopyexplorer ↗

   hash

   AAj8ktt8xY4Y…heekYqPCcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1308 B) ▸

   {"actor":"reviewer","artifact_identity":"587f9a1aec781927eebb560fe8eba4e2","decided_at":"2026-11-02T03:49:44.239Z","decision":"review","disputed_pct":0.4167,"findings_hash":"GfXkK9vScktENFruTg8cuySjmG9mCfBxJuQkZLR59YpW","investigation_id":"39910c40-bf09-4d18-b078-4b9b70b813a6","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":49,"page_content_hash":"693e0c3dad6229d928ee7617215e7197a15f6f507674470e468fae81f3a593e0","page_slug":"purrlend","prev_score":49,"reason":"Core facts (April 25, 2026 exploit, about $1.52M loss, 2-of-3 multisig without timelock, bridge role, Kirby Ong flag, TVL drop) hold up against the fetched sources. Weaker points are the exact 1:20 a.m. UTC time, the 9:10 UTC pause time (possibly conflated with a publication timestamp), the unsourced 'inside job' community allegation, and the MegaETH figure, which sources disagree on ($324,549 vs about $163K). The status as of late May 2026 is stale and I could not establish the current status.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":3,"subject_status":"unknown","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d405e3e5-b363-474b-8889-0ee43a2e91cacopy
4. #4review reviseby judgejudge

   2026-11-02 03:49:44Z
   Score: 49 → 49 (no score change)
   The core event holds up: the April 25, 2026 exploit, the roughly $1.52M loss, the 2-of-3 multisig with no timelock and the Kirby Ong flag are confirmed (claim_findings[0], [6], [9]). However, 5 of 12 claims (about 42%) could not be verified in any fetched source: the exact 1:20 a.m. UTC time, the community inside-job allegation, the 'no law enforcement referral' statement, the 'remains paused as of late May 2026' status, and the HyperEVM launch date (claim_findings[2], [4], [5], [10], [11]). Several other claims are only partly supported, including a MegaETH loss figure that sources put at either $324,549 or about $163K, a 9:10 UTC pause time that may be a publication timestamp, and an unsupported 'depositor flight' cause for the TVL drop (claim_findings[1], [3], [7], [8]). Nothing was found to be false, and the reviewer's confidence is moderate (0.55), so the penalty sits at the low end of the band. The page's status is also about five months old with a high-priority coverage gap on current status.
   anchoranchored

   chain

   ●mainnet-betaslot 464,350,137

   sig

   3fCgJqKcwm8z…8vxGSMQ4copyexplorer ↗

   hash

   67fmQfwGYfZP…J6JPga5ccopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1656 B) ▸

   {"actor":"judge","artifact_identity":"587f9a1aec781927eebb560fe8eba4e2","band_override":null,"decided_at":"2026-11-02T03:49:44.239Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.4167,"investigation_id":"39910c40-bf09-4d18-b078-4b9b70b813a6","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":49,"page_slug":"purrlend","prev_score":49,"reason":"The core event holds up: the April 25, 2026 exploit, the roughly $1.52M loss, the 2-of-3 multisig with no timelock and the Kirby Ong flag are confirmed (claim_findings[0], [6], [9]). However, 5 of 12 claims (about 42%) could not be verified in any fetched source: the exact 1:20 a.m. UTC time, the community inside-job allegation, the 'no law enforcement referral' statement, the 'remains paused as of late May 2026' status, and the HyperEVM launch date (claim_findings[2], [4], [5], [10], [11]). Several other claims are only partly supported, including a MegaETH loss figure that sources put at either $324,549 or about $163K, a 9:10 UTC pause time that may be a publication timestamp, and an unsupported 'depositor flight' cause for the TVL drop (claim_findings[1], [3], [7], [8]). Nothing was found to be false, and the reviewer's confidence is moderate (0.55), so the penalty sits at the low end of the band. The page's status is also about five months old with a high-priority coverage gap on current status.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 36ada755-2ca7-49b3-8f49-8a97754413b5copy
5. #5rescoreby systemsystem

   2026-11-02 03:49:45Z
   Score: 49 → 57 (+8)
   Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 49 → 57. Problems weighed by who is responsible: concerns that are not fraud −6.4, incidents the subject suffered −3.2, problems around the subject, caused by others −0.8; legitimacy credit long-running +2; 1 section(s) set aside until a failed fact-check is resolved.
   anchoranchored

   chain

   ●mainnet-betaslot 464,350,142

   sig

   48qZkZpA9mY7…nWNRRtpWcopyexplorer ↗

   hash

   DZT3QwbkBN6M…qUr4GE4Hcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (749 B) ▸

   {"actor":"system","decided_at":"2026-11-02T03:49:44.239Z","decision":"rescore","investigation_id":"39910c40-bf09-4d18-b078-4b9b70b813a6","new_score":57,"page_slug":"purrlend","prev_score":49,"reason":"Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 49 → 57. Problems weighed by who is responsible: concerns that are not fraud −6.4, incidents the subject suffered −3.2, problems around the subject, caused by others −0.8; legitimacy credit long-running +2; 1 section(s) set aside until a failed fact-check is resolved.","score_delta":8,"score_model":"v2","sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 044dfa4d-8cee-4c78-9ada-a0a1ff63fc8ecopy