Audit log

Every state-changing event for Rubic: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-28 03:34:43Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,639,372

   sig

   3YsZ3TtNmgxm…fdAkzZKxcopyexplorer ↗

   hash

   9Gmfm28ZNKA6…svosKgN6copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (5063 B) ▸

   {"actor":"system:backfill","investigation_id":"88f93946-9f2c-4759-9f76-2b60c05315a3","kind":"publish","page_slug":"rubic","published_at":"2026-05-28T03:34:43.595Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Rubic","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/tech/2022/11/02/cross-chain-dex-rubic-loses-over-1m-in-funds-after-hackers-gain-access-to-private-keys","type":"other","url":""},{"credibility":3,"name":"https://www.web3isgoinggreat.com/?id=rubic-exchange-private-key-compromised-token-plummets","type":"other","url":""},{"credibility":3,"name":"https://cryptonews.com/news/decentralized-exchange-rubic-loses-1000000-exploit-involving-private-keys/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://quillaudits.medium.com/decoding-rubic-exchange-exploit-quillaudits-44828e71c417","type":"other","url":""},{"credibility":3,"name":"https://www.web3isgoinggreat.com/?id=rubic-cross-chain-exchange-hacked","type":"other","url":""},{"credibility":3,"name":"https://crypto.news/rubic-dex-aggregator-hack-leads-to-1-4m-of-user-funds-stolen/","type":"other","url":""},{"credibility":3,"name":"https://coincodecap.com/the-cross-chain-aggregator-rubic-has-been-exploited-for-nearly-1-4-million","type":"other","url":""},{"credibility":3,"name":"https://revoke.cash/exploits/rubic","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rubic.exchange/blog/rubics-new-security-architecture/","type":"other","url":""},{"credibility":3,"name":"https://docs.rubic.finance/rubic/security","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.merklescience.com/blog/the-dfintoch-scam-origins-and-operations","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://tokeninsight.com/en/coins/rubic/team","type":"other","url":""},{"credibility":3,"name":"https://coinmarketcap.com/currencies/rubic/","type":"other","url":""},{"credibility":3,"name":"https://messari.io/report/understanding-rubic","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rubic.exchange/blog/rubics-2024-yearly-report/","type":"other","url":""},{"credibility":3,"name":"https://messari.io/report/rubic-q4-2024-brief","type":"other","url":""},{"credibility":3,"name":"https://messari.io/report/rubic-q1-2025-brief","type":"other","url":""}]}],"sources_used":[],"summary":"Rubic is a cross-chain DEX aggregator founded in 2020 by Vladimir Tikhomirov and Alexandra Korneva, supporting swaps across 90+ blockchains. The protocol suffered two significant security incidents within two months in late 2022: a private key compromise in November that drained approximately $1.2 million in RBC tokens, followed by a smart contract exploit on December 25, 2022 that stole roughly $1.4 million in user USDC. Both events caused severe token price collapses, though the platform subsequently implemented new security architecture and remained operational into 2025.","timeline":[{"date":"2017-01-01","event":"Founders Vladimir Tikhomirov and Alexandra Korneva launch MyWish, a smart contract platform, establishing the team's crypto background.","source":""},{"date":"2020-01-01","event":"Rubic project founded; team raises approximately $500,000 (1,800 ETH) in initial funding.","source":""},{"date":"2022-11-02","event":"Admin wallet private key compromised; attacker drains approximately 34 million RBC/BRBC tokens worth ~$1.2 million and sells on Uniswap and PancakeSwap. RBC price collapses over 98%.","source":""},{"date":"2022-12-25","event":"Smart contract exploit: attacker exploits USDC miswhitelisting and lack of input validation in routerCallNative to steal ~$1.4 million in USDC from 49 users. Funds laundered through Tornado Cash.","source":""},{"date":"2022-12-25","event":"Rubic pauses all contracts and advises users to revoke approvals via revoke.cash.","source":""},{"date":"2022-12-29","event":"Rubic publishes post-hack weekly report, announces compensation plan capped at $5,000 per affected user funded from founder personal savings.","source":""},{"date":"2023-04-03","event":"Rubic relaunches with new security architecture: MixBytes-audited contracts, Gnosis Safe multisig, new CISO hired, Immunefi bug bounty program launched.","source":""},{"date":"2023-05-01","event":"DFintoch collapse ($31.6M exit scam) investigated by ZachXBT; Merkle Science notes swap contracts used for DFintoch laundering were also associated with Rubic exploit proceeds.","source":""},{"date":"2024-12-31","event":"Rubic reports 2024 full-year metrics: 828K+ transactions, $391.5M volume, 369K+ wallets.","source":""},{"date":"2025-03-31","event":"Rubic reports Q1 2025 record: $433 million in transaction volume across 93 supported blockchains.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision f0bf3c49-b91c-4caa-bed2-7425272ce5e3copy
2. #2rescoreby systemsystem

   2026-10-10 18:46:26Z
   Score: 28 → 63 (+35)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 63. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −3.2, problems around the subject, caused by others −2.4; legitimacy credit long-running +10.
   anchoranchored

   chain

   ●mainnet-betaslot 455,366,182

   sig

   WFiWc4nwQWyz…JHAcVXYUcopyexplorer ↗

   hash

   3dp76VMnTSFt…AtkQVqnHcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (637 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:46:25.973Z","decision":"rescore","investigation_id":"88f93946-9f2c-4759-9f76-2b60c05315a3","new_score":63,"page_slug":"rubic","prev_score":28,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 63. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −3.2, problems around the subject, caused by others −2.4; legitimacy credit long-running +10.","score_delta":35,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 831ecab3-5b53-4e46-9bc3-095c4430adc5copy
3. #3reviewby reviewerreviewer

   2026-11-02 04:45:23Z
   Score: 63 → 63 (no score change)
   The core incident facts (Nov 2022 key compromise, Dec 2022 USDC exploit, Tornado Cash laundering, security overhaul, 2024 self-reported metrics) are supported by the sources I fetched. Weaker points are the compensation cap, personal-savings funding and 49-user figures, which the cited sources do not show, and the 2023 year of the April 3 relaunch, which the cited blog does not state. Not every claim was checked, including the DFintoch/ZachXBT section, the token economics and the Messari figures. No contradicting current status was found.
   anchoranchored

   chain

   ●mainnet-betaslot 464,365,694

   sig

   3fzi3ztSbs5Q…v3Gp6BM1copyexplorer ↗

   hash

   W5qZAqpqK6Mo…jmj7N8Dhcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1388 B) ▸

   {"actor":"reviewer","artifact_identity":"6282d418755fe49db1cbd4182dae33ee","blocked_count":1,"decided_at":"2026-11-02T04:45:23.830Z","decision":"review","disputed_pct":0.2222,"findings_hash":"4jCXM1ADZ1Kn3j8Ya8YEyN8GTvfhsMPK9CSGv6yyz4WP","investigation_id":"88f93946-9f2c-4759-9f76-2b60c05315a3","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":63,"page_content_hash":"6e567be376e9d16a8ef17ad0bc1666e5ebb1b1f1d0bda768b47429c1a89d2659","page_slug":"rubic","prev_score":63,"reason":"The core incident facts (Nov 2022 key compromise, Dec 2022 USDC exploit, Tornado Cash laundering, security overhaul, 2024 self-reported metrics) are supported by the sources I fetched. Weaker points are the compensation cap, personal-savings funding and 49-user figures, which the cited sources do not show, and the 2023 year of the April 3 relaunch, which the cited blog does not state. Not every claim was checked, including the DFintoch/ZachXBT section, the token economics and the Messari figures. No contradicting current status was found.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":9,"sequence_num":3,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision c7d7e90c-68fe-4490-a32d-c82f2aa12b5ccopy
4. #4review reviseby judgejudge

   2026-11-02 04:45:24Z
   Score: 63 → 63 (no score change)
   Of 9 checkable claims (one was excluded because its source blocked the reviewer), none were disputed and 2 could not be verified, giving about 22%, which falls in the minor-issues band. The core incident facts (November 2022 key compromise, December 2022 USDC exploit, Tornado Cash laundering, security overhaul) are supported by Tier 1 and Tier 2 sources. The unverified items are the founder-funded $5,000 compensation cap and 49-user figure (claim_findings[3]) and the year of the April 3 relaunch (claim_findings[5]); two further claims were only partly supported (claim_findings[1], claim_findings[4]). No omissions or status contradictions were reported, and the reviewer's confidence was moderate (0.55), so the penalty is kept at the low end of the band.
   anchoranchored

   chain

   ●mainnet-betaslot 464,365,699

   sig

   41XhUp1FqrBS…2mbSKZG5copyexplorer ↗

   hash

   8tzrKSzxpN6D…5oSw8V4Jcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1437 B) ▸

   {"actor":"judge","artifact_identity":"6282d418755fe49db1cbd4182dae33ee","band_override":null,"blocked_count":1,"decided_at":"2026-11-02T04:45:23.830Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.2222,"investigation_id":"88f93946-9f2c-4759-9f76-2b60c05315a3","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":63,"page_slug":"rubic","prev_score":63,"reason":"Of 9 checkable claims (one was excluded because its source blocked the reviewer), none were disputed and 2 could not be verified, giving about 22%, which falls in the minor-issues band. The core incident facts (November 2022 key compromise, December 2022 USDC exploit, Tornado Cash laundering, security overhaul) are supported by Tier 1 and Tier 2 sources. The unverified items are the founder-funded $5,000 compensation cap and 49-user figure (claim_findings[3]) and the year of the April 3 relaunch (claim_findings[5]); two further claims were only partly supported (claim_findings[1], claim_findings[4]). No omissions or status contradictions were reported, and the reviewer's confidence was moderate (0.55), so the penalty is kept at the low end of the band.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":9,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 6e5f714f-3283-4a64-87f6-02385c32dfb7copy