Audit log

Every state-changing event for Toobit Exchange: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-10-06 12:07:55Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 453,897,169

   sig

   CzhbQvvJNwDw…RcZcNY7Qcopyexplorer ↗

   hash

   2fhptFfLe4NH…3gHJUqrncopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (14589 B) ▸

   {"actor":"system:backfill","investigation_id":"cdc56e65-d362-4453-97bd-5b5f6f3137e7","kind":"publish","page_slug":"toobit-exchange","published_at":"2026-10-06T12:07:55.645Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Toobit Exchange","sections":[{"content":"Toobit is operated by Hopeful Technology Co., Ltd, incorporated in the Cayman Islands, and press materials describe the exchange as having been established in October 2022. Public corporate filings and marketing materials do not disclose the identities of founders or ultimate beneficial owners. The exchange claims registration as a Money Services Business (MSB) with the US Financial Crimes Enforcement Network (FinCEN) under a specific registration number, a claim repeated by several review sites; however, at least one review source reported that Toobit did not appear on FinCEN's public MSB registry and held no state-level money transmission licenses in jurisdictions such as New York or Texas, concluding the exchange lacked the approvals required to legally serve US customers. Reviewers note that MSB registration, even where it applies, is a federal filing requirement rather than a consumer-protection license and does not provide deposit insurance or guaranteed dispute resolution. Toobit separately announced it had obtained a Virtual Asset Service Provider (VASP) registration from Poland's KNF financial regulator in March 2025. Dispute resolution under Toobit's terms is governed by Cayman Islands law with arbitration in Singapore, which reviewers describe as limiting practical recourse for retail users.","heading":"Corporate Structure and Regulatory Status","severity":"medium","sources":[{"credibility":2,"name":"Is Toobit Safe In 2026? (Coin Bureau)","type":"research","url":"https://coinbureau.com/education/is-toobit-safe"},{"credibility":2,"name":"Toobit Exchange Review (Coin Bureau)","type":"research","url":"https://coinbureau.com/review/toobit-review"},{"credibility":3,"name":"Is Toobit Legal in the US? Regulatory Status & Compliant Alternatives (Bitget Academy)","type":"other","url":"https://www.bitget.com/academy/toobit-us-regulation"},{"credibility":2,"name":"Toobit Obtains VASP License in Poland (GlobeNewswire)","type":"official","url":"https://www.globenewswire.com/news-release/2025/03/19/3045371/0/en/Toobit-Obtains-VASP-License-in-Poland.html"},{"credibility":3,"name":"Is Toobit Safe? 2026 Review of Fees, Security & Withdrawal Complaints (Coinspot)","type":"research","url":"https://coinspot.io/en/reviews/toobit-exchange/"}]},{"content":"A recurring complaint pattern appears across multiple independent review sites and Toobit's Trustpilot profile: users report that after achieving trading profits, their accounts were restricted and withdrawals blocked, often with vague justifications such as 'unfair trading practices,' 'illegal profits,' or 'liquidity arbitrage.' Trustpilot listed Toobit with a 'Poor'-to-'Average' TrustScore in the range of roughly 2.7–2.9 out of 5 across reviews spanning 2024 through 2026, with a large share of one-star reviews concentrated on this withdrawal-friction pattern. One reviewer described an account restricted after a profitable run with 'support only sending templates' and withdrawal fully blocked despite completed KYC; another reported being permitted to withdraw only their original deposit while Toobit characterized their trading profit as resulting from 'liquidity arbitrage.' Coin Bureau's review characterized the pattern — profit-triggered restrictions combined with generic support responses — as resembling behavior historically associated with 'bucket-shop'-style operations, while stopping short of confirming deliberate fraud. A separate review by Coinspot rated Toobit a 'High-Risk Project — Not Recommended' largely on this basis. Toobit's own terms of use reserve broad discretionary authority to limit account access, including login and withdrawal capability, which the company frames as a compliance and risk-control measure rather than a confiscation of profit. These claims rely primarily on aggregated user reviews and secondary review sites rather than regulatory findings, and should be treated as allegations rather than established fact.","heading":"Withdrawal Restrictions and Account Freezing Complaints","severity":"high","sources":[{"credibility":3,"name":"Toobit Reviews (Trustpilot)","type":"community_report","url":"https://www.trustpilot.com/review/www.toobit.com"},{"credibility":2,"name":"Is Toobit Safe In 2026? (Coin Bureau)","type":"research","url":"https://coinbureau.com/education/is-toobit-safe"},{"credibility":2,"name":"Toobit Exchange Review (Coin Bureau)","type":"research","url":"https://coinbureau.com/review/toobit-review"},{"credibility":3,"name":"Is Toobit Safe? 2026 Review of Fees, Security & Withdrawal Complaints (Coinspot)","type":"research","url":"https://coinspot.io/en/reviews/toobit-exchange/"}]},{"content":"On-chain investigator ZachXBT publicly criticized Toobit for listing BDAG, which he described as an alleged investment-scam token, shortly after the exchange announced the listing. According to reporting on the exchange, ZachXBT stated that Toobit 'does not disclose any details about its co-founders, legal entity, or licenses,' and framed the listing as evidence of a lapse in the exchange's listing due diligence. The underlying token, BDAG, reportedly exhibited characteristics commonly associated with scams, including an anonymous team and promises of outsized returns. This allegation has not been independently confirmed by a regulator or court, and is reported here based on a single crypto news outlet's coverage of ZachXBT's public statement.","heading":"Token Listing Due Diligence Concerns","severity":"medium","sources":[{"credibility":2,"name":"ZachXBT Exposes Toobit for Listing Alleged BDAG Scam Token","type":"news_article","url":"https://cryptonews.net/news/security/32795285/"}]},{"content":"Toobit has publicly disputed several claims circulating about it. In one announcement, Toobit stated that 'a fabricated image is being circulated, falsely claiming that Toobit has been listed by Cointelegraph as a fraudulent exchange,' adding that 'Cointelegraph has confirmed that they have never published such content' and that it was pursuing legal action against those responsible for spreading the image. Separately, Toobit issued a statement responding to claims about an alleged Dubai office and licensing, stating it does not operate a Dubai office, has no legal entity or local employees in Dubai, and has never claimed sponsorship of TOKEN2049 Dubai (clarifying its actual sponsorship was of a side event, Crypto Fight Night). A small crypto blog, by contrast, published an article alleging that Toobit falsely presented itself as a licensed Dubai-based exchange without a VARA or DET license and without published proof-of-reserves audits, alongside a list of user complaints about scam-token listings, trading pauses, and account lockdowns dated across early 2025. This blog post is a low-credibility, single-source account and its specific claims have not been independently corroborated; it is included here only to note the existence of the dispute, not as a verified finding.","heading":"Disputed Fraud and Licensing Claims","severity":"low","sources":[{"credibility":2,"name":"Toobit Announcement Center — Addressing False and Misleading Information Regarding Toobit","type":"official","url":"https://www.toobit.com/en-US/announcement/addressing-false-and-misleading-information-regarding-toobit"},{"credibility":2,"name":"Official Statement: False Claims Regarding Dubai Presence and Licensing","type":"official","url":"https://support.toobit.com/hc/en-us/articles/46698498231065-Official-Statement-False-Claims-Regarding-Dubai-Presence-and-Licensing"},{"credibility":3,"name":"Toobit's Dubai Scam: False Advertising, Unlicensed Operations (The Blockopedia)","type":"community_report","url":"https://theblockopedia.com/toobits-dubai-scam-false-advertising-unlicensed-operations-your-assets-are-exposed/"}]},{"content":"No source found in this investigation documents a confirmed hack or loss of user funds from Toobit's exchange infrastructure. Coin Bureau's review reports that Toobit's official X (Twitter) account was compromised in a phishing-related incident, with no stated impact on exchange wallets or user accounts. Toobit has commissioned multiple third-party penetration tests from security firm Hacken; one round, publicized in 2025, identified a total of 13 findings across its iOS and Android applications, described as mostly minor, which were subsequently resolved. Toobit also states it works with Beosin and Elliptic for compliance and anti-money-laundering monitoring. These audit relationships reduce — but do not eliminate — risk, since penetration tests of client applications do not address the withdrawal-restriction complaints described above, which concern account and compliance policy rather than application security.","heading":"Security Incidents and Audits","severity":"low","sources":[{"credibility":2,"name":"Is Toobit Safe In 2026? (Coin Bureau)","type":"research","url":"https://coinbureau.com/education/is-toobit-safe"},{"credibility":2,"name":"Toobit Successfully Completes Comprehensive Security Penetration Tests by Hacken (GlobeNewswire)","type":"official","url":"https://www.globenewswire.com/news-release/2025/08/25/3138282/0/en/Toobit-Successfully-Completes-Comprehensive-Security-Penetration-Tests-by-Hacken.html"}]}],"sources_used":[{"credibility":3,"name":"Toobit Reviews (Trustpilot)","type":"community_report","url":"https://www.trustpilot.com/review/www.toobit.com"},{"credibility":2,"name":"Is Toobit Safe In 2026? What Traders Should Know Before Using The Platform (Coin Bureau)","type":"research","url":"https://coinbureau.com/education/is-toobit-safe"},{"credibility":2,"name":"Toobit Exchange Review: Explore Features, Fees, and Security (2026) (Coin Bureau)","type":"research","url":"https://coinbureau.com/review/toobit-review"},{"credibility":3,"name":"Is Toobit Safe? 2026 Review of Fees, Security & Withdrawal Complaints (Coinspot)","type":"research","url":"https://coinspot.io/en/reviews/toobit-exchange/"},{"credibility":3,"name":"Is Toobit Legal in the US? Regulatory Status & Compliant Alternatives (Bitget Academy)","type":"other","url":"https://www.bitget.com/academy/toobit-us-regulation"},{"credibility":2,"name":"Toobit Obtains VASP License in Poland (GlobeNewswire)","type":"official","url":"https://www.globenewswire.com/news-release/2025/03/19/3045371/0/en/Toobit-Obtains-VASP-License-in-Poland.html"},{"credibility":2,"name":"ZachXBT Exposes Toobit for Listing Alleged BDAG Scam Token (Cryptonews.net)","type":"news_article","url":"https://cryptonews.net/news/security/32795285/"},{"credibility":2,"name":"Toobit Announcement Center — Addressing False and Misleading Information Regarding Toobit","type":"official","url":"https://www.toobit.com/en-US/announcement/addressing-false-and-misleading-information-regarding-toobit"},{"credibility":2,"name":"Official Statement: False Claims Regarding Dubai Presence and Licensing (Toobit Support)","type":"official","url":"https://support.toobit.com/hc/en-us/articles/46698498231065-Official-Statement-False-Claims-Regarding-Dubai-Presence-and-Licensing"},{"credibility":3,"name":"Toobit's Dubai Scam: False Advertising, Unlicensed Operations (The Blockopedia)","type":"community_report","url":"https://theblockopedia.com/toobits-dubai-scam-false-advertising-unlicensed-operations-your-assets-are-exposed/"},{"credibility":2,"name":"Toobit Successfully Completes Comprehensive Security Penetration Tests by Hacken (GlobeNewswire)","type":"official","url":"https://www.globenewswire.com/news-release/2025/08/25/3138282/0/en/Toobit-Successfully-Completes-Comprehensive-Security-Penetration-Tests-by-Hacken.html"}],"summary":"Toobit is an offshore cryptocurrency exchange, operated by Hopeful Technology Co., Ltd and incorporated in the Cayman Islands, that has existed since approximately October 2022. While the exchange holds a Polish VASP registration and has commissioned third-party security audits with no confirmed hack of exchange funds, it faces a recurring, multi-source pattern of user complaints alleging that profitable accounts are restricted and withdrawals of profits are blocked, as well as criticism over an undisclosed ownership structure, a disputed US regulatory registration, and due-diligence lapses in token listings. Toobit has publicly denied fraud and has rebutted a fabricated image purporting to show Cointelegraph labeling it a fraudulent exchange.","timeline":[{"date":"2022-10","event":"Toobit exchange is established, according to company marketing materials.","source":"VASP license press coverage","source_url":"https://www.globenewswire.com/news-release/2025/03/19/3045371/0/en/Toobit-Obtains-VASP-License-in-Poland.html"},{"date":"2024-08","event":"Toobit discontinues services to United States-based customers, citing regulatory compliance considerations.","source":"Coin Bureau / aggregated reporting","source_url":"https://coinbureau.com/education/is-toobit-safe"},{"date":"2025-03","date_evidence":"Toobit Obtains VASP License in Poland","date_original":"2025-03-19","event":"Toobit announces it obtained a Virtual Asset Service Provider (VASP) registration from Poland's KNF financial regulator.","source":"GlobeNewswire","source_url":"https://www.globenewswire.com/news-release/2025/03/19/3045371/0/en/Toobit-Obtains-VASP-License-in-Poland.html"},{"date":"2025-08","event":"Toobit publicly rebuts a circulating fabricated image that falsely claimed Cointelegraph had listed it as a fraudulent exchange, and announces legal action against those responsible.","source":"Toobit Announcement Center","source_url":"https://www.toobit.com/en-US/announcement/addressing-false-and-misleading-information-regarding-toobit"},{"date":"2025-08","event":"Toobit's official X (Twitter) account is reportedly compromised in a phishing-related incident; no impact on exchange wallets or user funds is reported.","source":"Coin Bureau","source_url":"https://coinbureau.com/review/toobit-review"},{"date":"2026-05-01","date_evidence":"01 May 2026 21:36, UTC","event":"Crypto news outlet reports that on-chain investigator ZachXBT publicly criticized Toobit for listing BDAG, calling it an alleged investment-scam token, shortly after the exchange announced the listing.","source":"Cryptonews.net","source_url":"https://cryptonews.net/news/security/32795285/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 41c5c34e-722b-4434-8890-cfa36afc03fdcopy