Audit log

Every state-changing event for Ribbon Finance: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.

1. #1publishby system:backfill

   2026-05-26 19:54:24Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,351,475

   sig

   4Q71jY1gfZq9…5VKr6x1rcopyexplorer ↗

   hash

   7y7CgYYNWCUq…CrDsJHxHcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6784 B) ▸

   {"actor":"system:backfill","investigation_id":"a6a1923c-821a-474d-bb68-9ecda1228d3b","kind":"publish","page_slug":"ribbon","published_at":"2026-05-26T19:54:24.475Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Ribbon Finance","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://docs.ribbon.finance/","type":"other","url":""},{"credibility":3,"name":"https://blockworks.co/news/ribbon-finance-governance-approves-aevo-brand-merger","type":"other","url":""},{"credibility":3,"name":"https://tokeninsight.com/en/news/ribbon-proposes-to-merge-into-aevo-wind-down-rbn-token-and-launch-new-token-aevo","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.theblock.co/post/382461/aevos-legacy-ribbon-dov-vaults-exploited-for-2-7-million-following-oracle-upgrade","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-aevo-ribbon-finance-hack-december-2025","type":"other","url":""},{"credibility":3,"name":"https://www.web3isgoinggreat.com/?id=ribbon-finance-exploit","type":"other","url":""},{"credibility":3,"name":"https://www.cryptopolitan.com/ribbon-finance-hacked-for-2-7-million/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coinspeaker.com/aevos-ribbon-vault-exploit-spurs-backlash-over-19-payout-plan/","type":"other","url":""},{"credibility":3,"name":"https://phemex.com/news/article/aevo-faces-criticism-over-ribbon-finance-exploit-recovery-plan-44840","type":"other","url":""},{"credibility":3,"name":"https://www.web3isgoinggreat.com/?id=ribbon-finance-exploit","type":"other","url":""},{"credibility":3,"name":"https://www.kucoin.com/news/flash/aevo-faces-backlash-over-proposed-recovery-plan-for-ribbon-finance-exploit","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/tech/2021/10/08/airdrop-ethics-vc-firm-draws-ire-following-25m-ribbon-finance-exploit","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/divergence-ventures-accused-of-insider-trading-as-analyst-cashes-out-2-5m/","type":"other","url":""},{"credibility":3,"name":"https://quadrigainitiative.com/casestudy/ribbonfinancesybilattack.php","type":"other","url":""},{"credibility":3,"name":"https://coinquora.com/divergence-ventures-returns-705-eth-to-rbn-network-solves-airdrop-issues/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://x.com/ribbonfinance/status/1540250826156871681","type":"other","url":""},{"credibility":3,"name":"https://tokeninsight.com/en/news/ribbon-finance-had-attack-on-website-dns-with-all-funds-on-vault-contract-unaffected","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://defillama.com/protocol/ribbon-finance","type":"other","url":""},{"credibility":3,"name":"https://www.coingecko.com/en/coins/ribbon-finance","type":"other","url":""},{"credibility":3,"name":"https://coinmarketcap.com/currencies/ribbon-finance/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blockworks.co/news/ribbon-finance-governance-approves-aevo-brand-merger","type":"other","url":""},{"credibility":3,"name":"https://gov.ribbon.finance/t/rgp-33-merge-ribbon-finance-into-aevo/709","type":"other","url":""},{"credibility":3,"name":"https://docs.ribbon.finance/ribbonomics/overview-and-rbn-tokenomics","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://docs.ribbon.finance/ribbon-lend/introduction-to-ribbon-lend","type":"other","url":""},{"credibility":3,"name":"https://www.fxstreet.com/cryptocurrencies/news/defi-token-holders-alert-ribbon-finances-lend-product-poses-risks-argues-analyst-202210181230","type":"other","url":""},{"credibility":3,"name":"https://gov.ribbon.finance/t/rgp-27-ribbon-lend-insurance-pool/652","type":"other","url":""}]}],"sources_used":[],"summary":"Ribbon Finance is an Ethereum-based DeFi protocol that pioneered Theta Vaults (DeFi Options Vaults) for structured yield products, later expanding into the Aevo derivatives exchange. The protocol has experienced multiple serious incidents including a $2.7 million oracle exploit in December 2025 whose recovery plan drew widespread community condemnation, a 2021 Sybil attack on its token airdrop by a connected venture capital firm, and a DNS hijacking in 2022. Its native token RBN lost approximately 90% of its value in 2025 alone and sits more than 99% below its all-time high.","timeline":[{"date":"2020-11-01","event":"Ribbon Finance co-founded by Julian Koh and Ken Chan.","source":""},{"date":"2021-05-01","event":"Theta Vaults (DeFi Options Vaults) launched on Ethereum mainnet.","source":""},{"date":"2021-10-08","event":"Divergence Ventures researcher exposed for Sybil attack on RBN airdrop; approximately $2.5 million in tokens claimed via dozens of wallets. Funds returned same day.","source":""},{"date":"2022-05-01","event":"Protocol loses over $100 million in TVL amid Terra/LUNA collapse and crypto market panic.","source":""},{"date":"2022-06-23","event":"DNS hijacking attack on app.ribbon.finance; two users approve malicious contracts; vault funds unaffected.","source":""},{"date":"2023-03-01","event":"Ribbon Finance launches Aevo options exchange mainnet on custom Ethereum rollup.","source":""},{"date":"2023-07-25","event":"Ribbon DAO approves RGP-33 merging Ribbon Finance into Aevo with 99.68% of votes in favor; 1:1 RBN-to-AEVO token migration authorized.","source":""},{"date":"2025-12-06","event":"Aevo deploys oracle upgrade adding 18-decimal precision support for stETH, PAXG, LINK, and AAVE — inadvertently introducing decimal mismatch and access control vulnerability in legacy Ribbon vaults.","source":""},{"date":"2025-12-12","event":"Attacker exploits oracle vulnerability in legacy Ribbon DOV vaults, draining approximately $2.7 million across ETH, wstETH, USDC, and WBTC. Stolen funds distributed to 15 wallet addresses.","source":""},{"date":"2025-12-13","event":"Aevo halts all Ribbon vaults and proposes 19% haircut recovery plan, relying on assumed dormancy of inactive accounts to fund active users' partial compensation. Aevo restricts X replies to verified accounts amid community backlash.","source":""},{"date":"2025-12-18","event":"Aevo reportedly reverses initial recovery plan; affected vault depositors face 100% loss. All Ribbon vaults decommissioned with claims window through June 12, 2026.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 411d2877-23c8-4fa7-bb64-036d603a7dc8copy