Audit log

Every state-changing event for ThalaSwap: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-20 03:37:11Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 420,905,951

   sig

   25TqELSxkYPm…oE9WqDHfcopyexplorer ↗

   hash

   HALS5dXKqGfB…ECj4r5FAcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (5565 B) ▸

   {"actor":"system:backfill","investigation_id":"9ef17dd6-b7aa-4c1a-ae5c-c52a6a15cc62","kind":"publish","page_slug":"thalaswap","published_at":"2026-05-20T03:37:11.036Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"ThalaSwap","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/177279/parafi-backs-thala-labs-6-million-raise-to-build-defi-stack-on-aptos-exclusive"},{"credibility":3,"name":"","type":"other","url":"https://defillama.com/protocol/thalaswap"},{"credibility":3,"name":"","type":"other","url":"https://www.signum.capital/blog/why-we-invested-in-thala-labs/"},{"credibility":3,"name":"","type":"other","url":"https://aptosnetwork.com/currents/ecosystem-spotlight-thala-building-defi-primitives-on-aptos"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://thalalabs.medium.com/thala-nov-15-post-mortem-5aea82bb3916"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-thala-hack-november-2024"},{"credibility":3,"name":"","type":"other","url":"https://x.com/ThalaLabs/status/1857703541089120541"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/thala-recovers-25-million-exploiter-hacker-caught"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://thalalabs.medium.com/thala-nov-15-post-mortem-5aea82bb3916"},{"credibility":3,"name":"","type":"other","url":"https://quadrigainitiative.com/casestudy/thalalabsv1farmingcontractvulnerability.php"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/thala-recovers-25-million-exploiter-hacker-caught"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://thalalabs.medium.com/thala-nov-15-post-mortem-5aea82bb3916"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/thala-recovers-25-million-exploiter-hacker-caught"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/326937/defi-protocol-thala-recovers-25-million-following-successful-hacker-negotiation"},{"credibility":3,"name":"","type":"other","url":"https://cybernews.com/crypto/hacked-crypto-project-thala-paid-to-recover-millions/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/177279/parafi-backs-thala-labs-6-million-raise-to-build-defi-stack-on-aptos-exclusive"},{"credibility":3,"name":"","type":"other","url":"https://www.signum.capital/blog/why-we-invested-in-thala-labs/"},{"credibility":3,"name":"","type":"other","url":"https://whitestarcapital.com/companies/thala-labs/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-thala-hack-november-2024"},{"credibility":3,"name":"","type":"other","url":"https://quadrigainitiative.com/casestudy/thalalabsv1farmingcontractvulnerability.php"},{"credibility":3,"name":"","type":"other","url":"https://defillama.com/protocol/thalaswap"},{"credibility":3,"name":"","type":"other","url":"https://thalalabs.medium.com/thala-nov-15-post-mortem-5aea82bb3916"}]}],"sources_used":[],"summary":"ThalaSwap is the decentralized exchange component of Thala Labs, an Aptos-based DeFi protocol offering an AMM, the Move Dollar (MOD) overcollateralized stablecoin, liquid staking, and a launchpad. On November 15, 2024, an input-validation bug introduced in a two-line patch to the v1 farming contract allowed an attacker to drain $25.5 million in liquidity pool tokens; funds were fully recovered within hours after SEAL 911 identified the exploiter via on-chain evidence and the attacker returned assets in exchange for a $300,000 bounty.","timeline":[{"date":"2022-10-25","event":"Thala Labs raises $6 million seed round co-led by ParaFi Capital, White Star Capital, and Shima Capital","source":""},{"date":"2023-04-06","event":"Thala protocol launches on Aptos mainnet; reaches $10M TVL within days","source":""},{"date":"2024-11-01","event":"Two-line patch deployed to v1 farming contract, introducing the unstake_max input-validation bug that bypassed standard security review","source":""},{"date":"2024-11-15","event":"Exploit begins at 4:46 AM PST from address 0xf7…; second larger drain completed at 7:10 AM PST from address 0x80…; total $25.5M in LP tokens stolen","source":""},{"date":"2024-11-15","event":"TVL alerts trigger at 5:12 AM PST; vulnerability identified by 7:30 AM PST; all relevant contracts paused; $11.5M in Thala assets frozen","source":""},{"date":"2024-11-15","event":"SEAL 911 and Ogle identify attacker via on-chain evidence within minutes; on-chain message sent to attacker at 9:34 AM PST","source":""},{"date":"2024-11-15","event":"Attacker agrees to return all funds by 10:13 AM PST in exchange for $300,000 protocol bounty and $40,000 personal payment; full recovery confirmed by 11:13 AM PST","source":""},{"date":"2024-11-16","event":"Thala Labs publishes post-mortem on Medium detailing root cause, timeline, and remediation steps including OtterSec re-audit and withdrawal rate limits","source":""},{"date":"2025-01-01","event":"ThalaSwap V3 (CLMM concentrated liquidity) becomes primary liquidity venue; protocol remains operational with $2.23M TVL as of mid-2026","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 085b024f-bdb6-4ca0-84eb-38ae395118b6copy
2. #2reviewby reviewerreviewer

   2026-08-19 04:00:06Z
   Score: 42 → 42 (no score change)
   This page is unusually well-sourced: nearly every timeline claim about the November 15, 2024 exploit — including exact PST timestamps, wallet-address prefixes, dollar figures, and the two-line-patch root cause — was verified verbatim against Thala Labs' own post-mortem (retrieved via Wayback Machine) and corroborated by independent security-firm and news coverage. No unhedged allegations of wrongdoing were found; the page consistently frames the incident as an exploit the protocol suffered, not fraud it committed, and it accurately reports the full, same-day recovery of all $25.5M. Two minor defects were found: the claimed November 16 publication date for the detailed Medium post-mortem conflicts with that article's own self-reported November 26, 2024 byline, and the 'mid-2026 $2.23M TVL' figure, while traceable to a real data point, reflects unusually volatile TVL (which has since roughly halved on the same listing) rather than a stable current state. This review could not audit the page's actual section prose because the input supplied blank section content.
   anchoranchored

   chain

   ●mainnet-betaslot 443,509,098

   sig

   5CdA1URxYkNJ…Y4zgazM8copyexplorer ↗

   hash

   A7HPJvsFmATq…Txv8amYVcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1421 B) ▸

   {"actor":"reviewer","decided_at":"2026-08-19T04:00:06.482Z","decision":"review","investigation_id":"9ef17dd6-b7aa-4c1a-ae5c-c52a6a15cc62","new_score":42,"page_slug":"thalaswap","prev_score":42,"reason":"This page is unusually well-sourced: nearly every timeline claim about the November 15, 2024 exploit — including exact PST timestamps, wallet-address prefixes, dollar figures, and the two-line-patch root cause — was verified verbatim against Thala Labs' own post-mortem (retrieved via Wayback Machine) and corroborated by independent security-firm and news coverage. No unhedged allegations of wrongdoing were found; the page consistently frames the incident as an exploit the protocol suffered, not fraud it committed, and it accurately reports the full, same-day recovery of all $25.5M. Two minor defects were found: the claimed November 16 publication date for the detailed Medium post-mortem conflicts with that article's own self-reported November 26, 2024 byline, and the 'mid-2026 $2.23M TVL' figure, while traceable to a real data point, reflects unusually volatile TVL (which has since roughly halved on the same listing) rather than a stable current state. This review could not audit the page's actual section prose because the input supplied blank section content.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 86db9a8e-8a51-426a-9ba6-b9719d1e7eaccopy
3. #3review approve with notesby judgejudge

   2026-08-19 04:00:06Z
   Score: 42 → 62 (+20)
   This is a calibration-only adjudication; the content review found no disputed claims (claim_findings show 10 confirmed, 2 partially_supported, 1 unverifiable, 0 disputed, disputed_pct 0.08), so the page's factual accuracy is not in question. The score is the problem: the incident is a suffered exploit (attribution 'b' per calibration_assessment.incident_attributions[0]) with an engineering-process failure as root cause, no evidence of insider misconduct, same-day full recovery of all $25.5M, a transparent public post-mortem, an OtterSec re-audit, and structural remediation (withdrawal rate limits). Per the rubric, a 'suffered' attribution caps the entity at CAUTIONARY (50-69), not WARNING (20-49); the current score of 42 (WARNING) misclassifies a well-handled, fully-recovered exploit as if it carried an own-conduct penalty. I agree with the reviewer's recommended band (CAUTIONARY) and score (62), which reflects strong incident response and remediation offset by the process failure that allowed an unreviewed patch to ship and by currently volatile, declining TVL. Notes: (Reconcile the Nov 16 post-mortem publication date in timeline[7] with the Medium article's own displayed byline of Nov 26, 2024; consider splitting into a Nov 16 announcement/tweet event and a separate Nov 26 detailed post-mortem event.) (Reframe the 'mid-2026 $2.23M TVL' figure in timeline[8] to note TVL volatility (ranged ~$5.3M-$2.2M within May 2026 alone, ~$613K on the v1/v2 listing as of review date) rather than presenting a single day's snapshot as a stable current state.) (Populate the blank section `content` and `heading` fields — the supplied page input had empty prose for every section, so editorial-language and causal-framing auditing could not be performed against actual reader-facing text.) (Consider adding coverage of: whether Thala's founders are publicly identified, whether a bug-bounty program (e.g., Immunefi) was established post-incident, and any MOD stablecoin peg-stability history independent of the exploit.)
   anchoranchored

   chain

   ●mainnet-betaslot 443,509,197

   sig

   45otc5gJ4zuC…5vmtCXvkcopyexplorer ↗

   hash

   D3SExuLJdW5K…vQ2MJpq6copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (2392 B) ▸

   {"actor":"judge","decided_at":"2026-08-19T04:00:06.482Z","decision":"review_approve_with_notes","investigation_id":"9ef17dd6-b7aa-4c1a-ae5c-c52a6a15cc62","new_score":62,"page_slug":"thalaswap","prev_score":42,"reason":"This is a calibration-only adjudication; the content review found no disputed claims (claim_findings show 10 confirmed, 2 partially_supported, 1 unverifiable, 0 disputed, disputed_pct 0.08), so the page's factual accuracy is not in question. The score is the problem: the incident is a suffered exploit (attribution 'b' per calibration_assessment.incident_attributions[0]) with an engineering-process failure as root cause, no evidence of insider misconduct, same-day full recovery of all $25.5M, a transparent public post-mortem, an OtterSec re-audit, and structural remediation (withdrawal rate limits). Per the rubric, a 'suffered' attribution caps the entity at CAUTIONARY (50-69), not WARNING (20-49); the current score of 42 (WARNING) misclassifies a well-handled, fully-recovered exploit as if it carried an own-conduct penalty. I agree with the reviewer's recommended band (CAUTIONARY) and score (62), which reflects strong incident response and remediation offset by the process failure that allowed an unreviewed patch to ship and by currently volatile, declining TVL. Notes: (Reconcile the Nov 16 post-mortem publication date in timeline[7] with the Medium article's own displayed byline of Nov 26, 2024; consider splitting into a Nov 16 announcement/tweet event and a separate Nov 26 detailed post-mortem event.) (Reframe the 'mid-2026 $2.23M TVL' figure in timeline[8] to note TVL volatility (ranged ~$5.3M-$2.2M within May 2026 alone, ~$613K on the v1/v2 listing as of review date) rather than presenting a single day's snapshot as a stable current state.) (Populate the blank section `content` and `heading` fields — the supplied page input had empty prose for every section, so editorial-language and causal-framing auditing could not be performed against actual reader-facing text.) (Consider adding coverage of: whether Thala's founders are publicly identified, whether a bug-bounty program (e.g., Immunefi) was established post-incident, and any MOD stablecoin peg-stability history independent of the exploit.)","score_delta":20,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision adf968ca-cef2-488b-9a01-cb8ceb24f6e9copy
4. #4reviewby reviewerreviewer

   2026-08-26 11:12:54Z
   Score: 62 → 62 (no score change)
   The page's account of the November 2024 ThalaSwap exploit is closely and precisely corroborated by Thala's own post-mortem and multiple independent outlets (Halborn, Cointelegraph, The Block, Cybernews, Quadriga Initiative), including exact timestamps, addresses, frozen-asset figures, and remediation steps. The one substantive defect is a mischaracterization of the $40,000 amount in the recovery timeline, which the primary source attributes to personal compensation for the Thala founders rather than an additional payment to the attacker; the closing claim about ThalaSwap V3's TVL and date of ascendance is directionally correct but its specific date and cited-source alignment are weak.
   anchoranchored

   chain

   ●mainnet-betaslot 443,520,288

   sig

   3woqe4ZGuiWk…X9DZJGD8copyexplorer ↗

   hash

   BXyWJW1S6Kp7…hMo9do4wcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1038 B) ▸

   {"actor":"reviewer","decided_at":"2026-08-26T11:12:54.202Z","decision":"review","investigation_id":"9ef17dd6-b7aa-4c1a-ae5c-c52a6a15cc62","new_score":62,"page_slug":"thalaswap","prev_score":62,"reason":"The page's account of the November 2024 ThalaSwap exploit is closely and precisely corroborated by Thala's own post-mortem and multiple independent outlets (Halborn, Cointelegraph, The Block, Cybernews, Quadriga Initiative), including exact timestamps, addresses, frozen-asset figures, and remediation steps. The one substantive defect is a mischaracterization of the $40,000 amount in the recovery timeline, which the primary source attributes to personal compensation for the Thala founders rather than an additional payment to the attacker; the closing claim about ThalaSwap V3's TVL and date of ascendance is directionally correct but its specific date and cited-source alignment are weak.","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 92e8f110-5a80-497f-ab39-57f2454eb520copy
5. #5review approveby judgejudge

   2026-08-26 11:12:54Z
   Score: 62 → 62 (no score change)
   The reviewer confirmed 10 of the page's 12 factual claims about the November 2024 ThalaSwap exploit against Thala's own post-mortem and independent outlets, including the $25.5 million loss, the $11.5 million asset freeze, the $300,000 bounty, the roughly 6.5-hour full recovery, and the OtterSec re-audit and rate-limit remediation. One claim was disputed (claim_findings[9]): the page implies the attacker received a $40,000 payment in addition to the bounty, when the primary source states that amount was personal compensation paid to the Thala founders, not the attacker — a payment-recipient misattribution rather than a dispute of the core incident facts. One claim about ThalaSwap V3's current TVL and the date it became the primary venue (claim_findings[10]) was only partially supported due to imprecise sourcing. With a disputed rate of about 8% ((1 disputed + 0 unverifiable) / 12), the page falls within the approval band, and the open coverage gaps are medium/low priority items about post-2025 developments rather than accuracy problems with what is currently published.
   anchoranchored

   chain

   ●mainnet-betaslot 443,520,292

   sig

   25yiRtJ39aX6…PhVeJU4Ncopyexplorer ↗

   hash

   7RtzThQaLGqW…5mP1ZXB4copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1435 B) ▸

   {"actor":"judge","decided_at":"2026-08-26T11:12:54.202Z","decision":"review_approve","investigation_id":"9ef17dd6-b7aa-4c1a-ae5c-c52a6a15cc62","new_score":62,"page_slug":"thalaswap","prev_score":62,"reason":"The reviewer confirmed 10 of the page's 12 factual claims about the November 2024 ThalaSwap exploit against Thala's own post-mortem and independent outlets, including the $25.5 million loss, the $11.5 million asset freeze, the $300,000 bounty, the roughly 6.5-hour full recovery, and the OtterSec re-audit and rate-limit remediation. One claim was disputed (claim_findings[9]): the page implies the attacker received a $40,000 payment in addition to the bounty, when the primary source states that amount was personal compensation paid to the Thala founders, not the attacker — a payment-recipient misattribution rather than a dispute of the core incident facts. One claim about ThalaSwap V3's current TVL and the date it became the primary venue (claim_findings[10]) was only partially supported due to imprecise sourcing. With a disputed rate of about 8% ((1 disputed + 0 unverifiable) / 12), the page falls within the approval band, and the open coverage gaps are medium/low priority items about post-2025 developments rather than accuracy problems with what is currently published.","score_delta":0,"sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 6fbd675b-d68a-495e-9924-5dec6bb64c2acopy
6. #6reviewby reviewerreviewer

   2026-09-09 03:05:17Z
   Score: 62 → 62 (no score change)
   Findings-only fact-check (retroactive anchor of stored findings)
   anchoranchored

   chain

   ●mainnet-betaslot 445,506,900

   sig

   mnJPmii6xBHg…KPDg7wPMcopyexplorer ↗

   hash

   5Ewdxd6c6R3Q…b21o5Hhecopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (702 B) ▸

   {"actor":"reviewer","artifact_identity":"9552a7b4ef01a5907f4dcd707f18e0d6","decided_at":"2026-09-07T00:19:53.696875+00:00","decision":"review","findings_count":25,"findings_rows_hash":"f6c35ea21c54f28afe9e05ea6991a53a5368f2e7bb37af74154959d742cdc13f","investigation_id":"9ef17dd6-b7aa-4c1a-ae5c-c52a6a15cc62","mode":"findings_only_retroactive","new_score":62,"page_content_hash":"302eedff05d8070eee0d03b4f7505ad136dba9a69b2758a951b924589803d208","page_slug":"thalaswap","prev_score":62,"reason":"Findings-only fact-check (retroactive anchor of stored findings)","score_delta":0,"sequence_num":6,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 01327ec3-2163-4041-8e7e-cad7886ac556copy