Audit log

Every state-changing event for Resolv: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-19 20:13:20Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 420,839,291

   sig

   5VpRMwLVMpwn…M1E4MsxWcopyexplorer ↗

   hash

   EGkwQKSZ16pE…sqPXQttNcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (5469 B) ▸

   {"actor":"system:backfill","investigation_id":"7d3916be-be64-4d1c-b1fe-f9509b3dd168","kind":"publish","page_slug":"resolv","published_at":"2026-05-19T20:13:20.243Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Resolv","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2025/04/15/resolv-labs-raises-usd10m-as-crypto-investor-appetite-for-yield-bearing-stablecoins-soars"},{"credibility":3,"name":"","type":"other","url":"https://thedefiant.io/news/defi/stablecoin-protocol-resolv-s-tvl-soars-above-usd400-million"},{"credibility":3,"name":"","type":"other","url":"https://cryptorank.io/ico/resolv"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-resolv-hack-march-2026"},{"credibility":3,"name":"","type":"other","url":"https://coinbureau.com/review/resolv-protocol-review/"},{"credibility":3,"name":"","type":"other","url":"https://www.chainalysis.com/blog/lessons-from-the-resolv-hack/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://resolv.xyz/blog/resolv-postmortem-march-22-2026-incident"},{"credibility":3,"name":"","type":"other","url":"https://www.chainalysis.com/blog/lessons-from-the-resolv-hack/"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-resolv-hack-march-2026"},{"credibility":3,"name":"","type":"other","url":"https://github.com/mixbytes/audits_public/blob/master/Resolv/Treasury%20Extension/README.md"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/markets/2026/03/23/resolv-stablecoin-drops-70-after-usd80-million-exploit-after-attacker-mints-usr"},{"credibility":3,"name":"","type":"other","url":"https://www.govinfosecurity.com/cryptohack-roundup-hacker-mints-24m-from-resolv-a-31196"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.crunchbase.com/person/ivan-kozlov-4bb9"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2025/04/15/resolv-labs-raises-usd10m-as-crypto-investor-appetite-for-yield-bearing-stablecoins-soars"},{"credibility":3,"name":"","type":"other","url":"https://wellfound.com/company/resolv-labs-1/people"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://resolv.xyz/blog/resolv-postmortem-march-22-2026-incident"},{"credibility":3,"name":"","type":"other","url":"https://www.chainalysis.com/blog/lessons-from-the-resolv-hack/"},{"credibility":3,"name":"","type":"other","url":"https://blockaid.io/blog/how-a-compromised-key-minted-80m-in-resolvs-usr-stablecoin-and-triggered-a-depeg"},{"credibility":3,"name":"","type":"other","url":"https://finance.yahoo.com/markets/crypto/articles/resolv-23m-hack-highlights-defi-174413345.html"},{"credibility":3,"name":"","type":"other","url":"https://www.quillaudits.com/blog/hack-analysis/resolv-labs-exploit-explained"},{"credibility":3,"name":"","type":"other","url":"https://news.bitcoin.com/resolv-labs-pauses-protocol-after-23m-exploit-triggers-usr-stablecoin-depeg/"}]}],"sources_used":[],"summary":"Resolv is a DeFi protocol issuing USR, a delta-neutral stablecoin backed by ETH with perpetual futures hedging, developed by Resolv Labs. On March 22, 2026, the protocol suffered a critical exploit in which an attacker compromised Resolv's AWS key management infrastructure to mint 80 million unbacked USR tokens, extracting approximately $23–25 million in ETH and triggering a severe stablecoin depeg. The protocol remains paused as of May 2026 while recovery and infrastructure remediation are underway.","timeline":[{"date":"2024-11-01","event":"Resolv protocol launches; TVL begins growing rapidly, rising over 380% through November–December 2024.","source":""},{"date":"2024-12-01","event":"Resolv TVL hits $77 million all-time high at the time, per DeFiLlama.","source":""},{"date":"2025-01-06","event":"Resolv TVL peaks at approximately $448 million, per DeFiLlama.","source":""},{"date":"2025-04-15","event":"Resolv Labs announces $10 million seed funding led by Cyber.Fund and Maven 11, with participation from Coinbase Ventures, Animoca Ventures, Arrington Capital, and others.","source":""},{"date":"2026-03-22","event":"Critical exploit: attacker compromises AWS KMS signing key via GitHub Actions credential exfiltration from a contractor's account. Mints 80 million USR in two transactions using ~$100K–$200K USDC, extracting $23–25M in ETH. USR depegs to $0.0025 on Curve. Protocol paused at 05:16 UTC.","source":""},{"date":"2026-03-23","event":"CoinDesk and major outlets report on the exploit. Fluid/Instadapp confirms over $10 million in bad debt and $300 million in outflows attributed to the Resolv depeg.","source":""},{"date":"2026-03-26","event":"Resolv Labs publishes official postmortem. 46 million of the 80 million illicitly minted USR burned or blacklisted. External forensic investigation begins with Hypernative, Hexens, MixBytes, SEAL 911, Mandiant, and ZeroShadow.","source":""},{"date":"2026-05-11","event":"Resolv Labs posts update on X confirming ongoing recovery coordination with affected counterparties. Protocol has not relaunched as of this date.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 56ec6b5b-f67a-44e0-9a7c-7beb258b1369copy
2. #2rescoreby systemsystem

   2026-10-10 18:49:01Z
   Score: 22 → 53 (+31)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 22 → 53. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −6.4, problems around the subject, caused by others −0.8; legitimacy credit long-running +2.
   anchoranchored

   chain

   ●mainnet-betaslot 455,368,984

   sig

   2oP9h78ZSPoo…mT7o34Ptcopyexplorer ↗

   hash

   C1dQ9rv6iGyw…XMvSkk9Pcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (637 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:49:01.195Z","decision":"rescore","investigation_id":"7d3916be-be64-4d1c-b1fe-f9509b3dd168","new_score":53,"page_slug":"resolv","prev_score":22,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 22 → 53. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −6.4, problems around the subject, caused by others −0.8; legitimacy credit long-running +2.","score_delta":31,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision c7a13446-4c50-4c99-8a2b-89569c1edccecopy
3. #3acceptby agent:avoid-moderatoranalyzer

   2026-10-22 00:11:03Z
   Score: 53 → 52 (-1)
   Chainalysis's own post-mortem confirms an AWS KMS key compromise let the attacker mint ~80M USR (~$23-25M extracted) with no on-chain maximum-mint safeguard, matching the note fully.
   Source:https://www.chainalysis.com/blog/lessons-from-the-resolv-hack/

   Wayback:archived snapshot2026-10-08 11:17:41Z
   anchoranchored

   chain

   ●mainnet-betaslot 459,826,979

   sig

   5osW57Jkbrj4…tSJWTzfocopyexplorer ↗

   hash

   5uDWHD1v2FL5…Nz5xZWkicopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (646 B) ▸

   {"actor":"agent:avoid-moderator","decided_at":"2026-10-22T00:11:02.861Z","decision":"accept","investigation_id":"7d3916be-be64-4d1c-b1fe-f9509b3dd168","new_score":52,"page_slug":"resolv","prev_score":53,"reason":"Chainalysis's own post-mortem confirms an AWS KMS key compromise let the attacker mint ~80M USR (~$23-25M extracted) with no on-chain maximum-mint safeguard, matching the note fully.","score_delta":-1,"sequence_num":3,"submission_content_hash":"a2c091d69d3d9e9ec0d2bc09c8ee7a1257edb52dda16e92033435dd0a3f1d49d","submission_id":"c1b87c02-657a-43b5-90d3-385c4603d63c","submission_kind":"url","submission_valence":"incriminating","v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 59c8e77f-e5e6-4b5f-b584-e9e3466a2f8bcopy
4. #4reviewby reviewerreviewer

   2026-11-02 05:42:49Z
   Score: 52 → 52 (no score change)
   The core exploit narrative (AWS KMS key compromise, 80M USR minted in two transactions, about $25M extracted, pause at 05:16 UTC) matches the official postmortem and Chainalysis. Problems: the $0.0025 depeg low conflicts with other sources, Mandiant and ZeroShadow are described as engaged when the postmortem says planned, the postmortem is dated 2026-03-26 but is dated April 4, and the GitHub contractor chain is not supported by two of the cited sources. The May 2026 status is unsourced and the subject's current status could not be determined.
   anchoranchored

   chain

   ●mainnet-betaslot 464,381,826

   sig

   5oiz2AQHg237…J32Nbiqfcopyexplorer ↗

   hash

   9V5unqHRaatT…1jKpQoUhcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1390 B) ▸

   {"actor":"reviewer","artifact_identity":"348aff7ea5e1174bbc5177589423c607","decided_at":"2026-11-02T05:42:49.503Z","decision":"review","disputed_pct":0.4,"findings_hash":"HLJnnJ79vy5MRQzTp7MHkqwSJhdtvkKsjQx7CEHHaGjp","investigation_id":"7d3916be-be64-4d1c-b1fe-f9509b3dd168","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":52,"omissions":{"material":0,"total":1},"page_content_hash":"d7bf017ef05795dff1fc70996c21791238484a377aba82980ac3b807931fc7ad","page_slug":"resolv","prev_score":52,"reason":"The core exploit narrative (AWS KMS key compromise, 80M USR minted in two transactions, about $25M extracted, pause at 05:16 UTC) matches the official postmortem and Chainalysis. Problems: the $0.0025 depeg low conflicts with other sources, Mandiant and ZeroShadow are described as engaged when the postmortem says planned, the postmortem is dated 2026-03-26 but is dated April 4, and the GitHub contractor chain is not supported by two of the cited sources. The May 2026 status is unsourced and the subject's current status could not be determined.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"subject_status":"unknown","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision f0340837-a2cb-4de4-97f2-b0fa744c75b7copy
5. #5review reviseby judgejudge

   2026-11-02 05:42:49Z
   Score: 52 → 52 (no score change)
   About 36% of the 11 reviewed claims were disputed or could not be verified (4 of 11). The core exploit account (key compromise, 80M USR minted, roughly $25M extracted, pause at 05:16 UTC) matches the official postmortem (claim_findings[0], [5]). The problems are at the edges: Mandiant and ZeroShadow are described as engaged when the postmortem says planned (claim_findings[2]), the postmortem is dated 2026-03-26 but the source dates it April 4 (claim_findings[3]), and the May 2026 status and the peak TVL figure could not be sourced (claim_findings[7], [9]). The depeg low and the GitHub contractor attack chain are only partly supported, and the page's status is stale, so it needs correction and a refresh. The penalty is kept in the lower part of the band because the central allegations hold up and the disputed items are mostly peripheral.
   anchoranchored

   chain

   ●mainnet-betaslot 464,381,831

   sig

   5LCu2izzGGDs…UVNeXkZNcopyexplorer ↗

   hash

   4R2wSjaENNDd…5JavvdYjcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1485 B) ▸

   {"actor":"judge","artifact_identity":"348aff7ea5e1174bbc5177589423c607","band_override":null,"decided_at":"2026-11-02T05:42:49.503Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.4,"investigation_id":"7d3916be-be64-4d1c-b1fe-f9509b3dd168","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":52,"page_slug":"resolv","prev_score":52,"reason":"About 36% of the 11 reviewed claims were disputed or could not be verified (4 of 11). The core exploit account (key compromise, 80M USR minted, roughly $25M extracted, pause at 05:16 UTC) matches the official postmortem (claim_findings[0], [5]). The problems are at the edges: Mandiant and ZeroShadow are described as engaged when the postmortem says planned (claim_findings[2]), the postmortem is dated 2026-03-26 but the source dates it April 4 (claim_findings[3]), and the May 2026 status and the peak TVL figure could not be sourced (claim_findings[7], [9]). The depeg low and the GitHub contractor attack chain are only partly supported, and the page's status is stale, so it needs correction and a refresh. The penalty is kept in the lower part of the band because the central allegations hold up and the disputed items are mostly peripheral.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 5dd1b4d2-f73f-4181-9fe9-7d676d0c293acopy