Audit log

Every state-changing event for StableMagnet: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-26 03:49:38Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,206,362

   sig

   553pkAF7MGTR…eSgby3pScopyexplorer ↗

   hash

   3PVBfqYyCfFX…Vz4N3ortcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6195 B) ▸

   {"actor":"system:backfill","investigation_id":"3699ba84-0fa1-46e7-9d11-c82e2519a088","kind":"publish","page_slug":"stablemagnet","published_at":"2026-05-26T03:49:38.404Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"StableMagnet","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-stablemagnet-rugpull-june-2021","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/stablemagnet-rekt","type":"other","url":""},{"credibility":3,"name":"https://www.quadrigainitiative.com/casestudy/stablemagnetexitscam.php","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/stablemagnet-rekt","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-stablemagnet-rugpull-june-2021","type":"other","url":""},{"credibility":3,"name":"https://www.quadrigainitiative.com/casestudy/stablemagnetexitscam.php","type":"other","url":""},{"credibility":3,"name":"https://x.com/peckshield/status/1407845381312892931","type":"other","url":""},{"credibility":3,"name":"https://smartcontractshacking.com/hacks/stablemagnet-hack-2021","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://github.com/TechRate/Smart-Contract-Audits","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-stablemagnet-rugpull-june-2021","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/stablemagnet-rekt","type":"other","url":""},{"credibility":3,"name":"https://www.quadrigainitiative.com/casestudy/stablemagnetexitscam.php","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.banklesstimes.com/news/2023/01/31/ethical-hacker-helps-recover-millions-lost-in-stablemagnet-rug-pull/","type":"other","url":""},{"credibility":3,"name":"https://www.quadrigainitiative.com/casestudy/stablemagnetexitscam.php","type":"other","url":""},{"credibility":3,"name":"https://www.cryptopolitan.com/defi-scammers-tracked-down-after-a-25-million-rug-pull/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://revoke.cash/exploits/stablemagnet","type":"other","url":""},{"credibility":3,"name":"https://www.quadrigainitiative.com/casestudy/stablemagnetexitscam.php","type":"other","url":""},{"credibility":3,"name":"https://www.web3isgoinggreat.com/?id=2021-06-23-0","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-stablemagnet-rugpull-june-2021","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/stablemagnet-rekt","type":"other","url":""},{"credibility":3,"name":"https://x.com/peckshield/status/1407845381312892931","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://x.com/peckshield/status/1407845381312892931","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/stablemagnet-rekt","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/stablemagnet-rekt","type":"other","url":""},{"credibility":3,"name":"https://bscscan.com/address/0xb89e9365cb5bacfcf4a4b0386dfad45c3b4d3258","type":"other","url":""},{"credibility":3,"name":"https://x.com/peckshield/status/1407845381312892931","type":"other","url":""}]}],"sources_used":[],"summary":"StableMagnet was a stablecoin yield and DEX protocol launched on Binance Smart Chain (BSC) that executed a deliberate rug pull on June 23-24, 2021, stealing approximately $27 million in USDT, USDC, and BUSD from over 1,000 users. The team concealed a malicious backdoor by substituting an unverified SwapUtils library for the one shown in publicly audited source code — a novel attack vector that exposed a critical gap in how block explorers verify linked library code. Following an anonymous white-hat investigation and Manchester police arrests, most of the stolen funds were eventually returned by late 2022.","timeline":[{"date":"2021-06-01","event":"StableMagnet launches on Binance Smart Chain, offering a USDT/USDC/BUSD 3Pool stablecoin DEX with a TechRate audit in place.","source":""},{"date":"2021-06-23","event":"StableMagnet team activates malicious backdoor in the unverified SwapUtils library (0xE25d05777BB4bD0FD0Ca1297C434e612803eaA9a), draining approximately $22.2 million in USDT, USDC, and BUSD from the 3Pool and sweeping tokens from wallets with open approvals. Total losses reach approximately $27 million.","source":""},{"date":"2021-06-24","event":"PeckShield alerts the crypto community on Twitter that StableMagnet's SwapUtils library is unverified and different from the main swap contract source code, urging users to revoke approvals immediately. Rekt News publishes a detailed post-mortem.","source":""},{"date":"2021-06-24","event":"Stolen funds are bridged from BSC to Ethereum via AnySwap/Multichain and converted from USDT to DAI in an apparent laundering attempt. All StableMagnet websites and social media accounts go offline.","source":""},{"date":"2021-07-01","event":"Halborn publishes detailed technical analysis of the library substitution attack vector, noting the structural verification gap in Etherscan and BscScan.","source":""},{"date":"2022-01-30","event":"An anonymous white-hat hacker goes public (via CoinTelegraph and Bankless Times coverage) with details of their investigation: they identified alleged perpetrators as Hong Kong-based individuals, tracked their travel to Manchester, UK, and cooperated with Manchester police, who arrested suspects and recovered approximately $9 million from a USB device.","source":""},{"date":"2022-12-01","event":"Approximately $24 million of the originally stolen $27 million is reported returned to victims, following arrests and cooperation from alleged co-conspirators, per Quadriga Initiative records.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 0b846b69-60b3-435f-82ee-b1a569e26be4copy
2. #2rescoreby systemsystem

   2026-10-27 06:03:12Z
   Score: 2 → 0 (-2)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 2 → 0. The page establishes that the subject is itself a scheme, so the score is 0.
   anchoranchored

   chain

   ●mainnet-betaslot 461,962,601

   sig

   3SiRrCbw5reF…CkvSkRcPcopyexplorer ↗

   hash

   B34pVTA2RS7p…gXzEAh9ccopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (518 B) ▸

   {"actor":"system","decided_at":"2026-10-27T06:03:12.175Z","decision":"rescore","investigation_id":"3699ba84-0fa1-46e7-9d11-c82e2519a088","new_score":0,"page_slug":"stablemagnet","prev_score":2,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 2 → 0. The page establishes that the subject is itself a scheme, so the score is 0.","score_delta":-2,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 4507bb04-0db5-40cb-9b51-8ba54d573a03copy
3. #3reviewby reviewerreviewer

   2026-11-01 23:03:02Z
   Score: 0 → 0 (no score change)
   The core incident is well supported: the June 2021 rug pull, about $27M lost, the unverified SwapUtils library, the explorer linked-library gap and the TechRate audit gap all match Rekt, Halborn and Revoke.cash. The recovery narrative is the weak point. The $24M returned by 1 Dec 2022 figure is attributed to a Quadriga page that does not say it, and it conflicts with Revoke.cash, which says only a small part is confirmed returned. Arrests actually occurred in August 2021 and the page omits that. The AnySwap bridge detail, the per-token split and the ZachXBT flagging are unsupported.
   anchoranchored

   chain

   ●mainnet-betaslot 464,269,843

   sig

   3NDTxdhojm3L…g2upp9BVcopyexplorer ↗

   hash

   ELBDKhskzACi…C6jXAPtTcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1439 B) ▸

   {"actor":"reviewer","artifact_identity":"43706de8d169884d9f029125e10a731e","decided_at":"2026-11-01T23:03:02.193Z","decision":"review","disputed_pct":0.3571,"findings_hash":"AzVPSA9k4GG72NtSmBRvcTSiyjt2q9PQE58hBuNYr5AE","investigation_id":"3699ba84-0fa1-46e7-9d11-c82e2519a088","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":0,"omissions":{"material":1,"total":2},"page_content_hash":"9d32fd1a600fba64006696ecf3a5a443d0123000c2fe93ddae917dba55963119","page_slug":"stablemagnet","prev_score":0,"reason":"The core incident is well supported: the June 2021 rug pull, about $27M lost, the unverified SwapUtils library, the explorer linked-library gap and the TechRate audit gap all match Rekt, Halborn and Revoke.cash. The recovery narrative is the weak point. The $24M returned by 1 Dec 2022 figure is attributed to a Quadriga page that does not say it, and it conflicts with Revoke.cash, which says only a small part is confirmed returned. Arrests actually occurred in August 2021 and the page omits that. The AnySwap bridge detail, the per-token split and the ZachXBT flagging are unsupported.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":3,"subject_status":"shut_down","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 36646bf3-f410-43d8-bda1-863e3bfd64f3copy
4. #4review reviseby judgejudge

   2026-11-01 23:03:02Z
   Score: 0 → 0 (no score change)
   Of 14 checked claims, 3 were disputed and 2 could not be verified, so about 36% did not hold up, which falls in the significant-issues band. The three disputed findings (claim_findings[0], [1], [2]) all concern one claim: that about $24M, or most of the stolen funds, was returned by December 2022. The Quadriga page cited for that figure does not contain it, and Revoke.cash says only a small part is confirmed returned. The page also omits that arrests and the police seizure happened in August 2021 (omission_findings[0]), and the AnySwap bridge route, the per-token split and the ZachXBT flagging are unsupported. The core incident is well supported (the June 2021 rug pull, about $27M lost, the SwapUtils library, the TechRate audit gap), so the page is revised rather than denied.
   anchoranchored

   chain

   ●mainnet-betaslot 464,269,848

   sig

   iNChgzNLq53D…VsiSHQtCcopyexplorer ↗

   hash

   2mk1dAFMhs1d…9r11yet3copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1778 B) ▸

   {"actor":"judge","artifact_identity":"43706de8d169884d9f029125e10a731e","band_override":null,"decided_at":"2026-11-01T23:03:02.193Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.3571,"investigation_id":"3699ba84-0fa1-46e7-9d11-c82e2519a088","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":0,"page_slug":"stablemagnet","prev_score":0,"reason":"Of 14 checked claims, 3 were disputed and 2 could not be verified, so about 36% did not hold up, which falls in the significant-issues band. The three disputed findings (claim_findings[0], [1], [2]) all concern one claim: that about $24M, or most of the stolen funds, was returned by December 2022. The Quadriga page cited for that figure does not contain it, and Revoke.cash says only a small part is confirmed returned. The page also omits that arrests and the police seizure happened in August 2021 (omission_findings[0]), and the AnySwap bridge route, the per-token split and the ZachXBT flagging are unsupported. The core incident is well supported (the June 2021 rug pull, about $27M lost, the SwapUtils library, the TechRate audit gap), so the page is revised rather than denied.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"severity_override":{"applied":true,"band":"significant","from_band":"significant","reason":"omission_findings[0] is material: the page dates the arrests and recovery to 2022, while Forklog and Revoke.cash report arrests and about $22.2M seized in August 2021. This confirms the significant band implied by the percentage and rules out approval."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ffb8292b-f0c1-493e-8336-71955c423896copy