Audit log

Every state-changing event for Truebit: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-20 03:30:52Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 420,905,016

   sig

   61XAew2thDMX…aAeArTnGcopyexplorer ↗

   hash

   GB6TddMyYFU1…JPRY8AoKcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (5147 B) ▸

   {"actor":"system:backfill","investigation_id":"83bdefdc-450d-4615-80d7-d8f4b27817c1","kind":"publish","page_slug":"truebit","published_at":"2026-05-20T03:30:52.667Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Truebit","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://iq.wiki/wiki/truebit-protocol"},{"credibility":3,"name":"","type":"other","url":"https://truebit.io/about/"},{"credibility":3,"name":"","type":"other","url":"https://truebit.io/acm-ccs-test-of-time-award/"},{"credibility":3,"name":"","type":"other","url":"https://medium.com/truebit/truebit-the-marketplace-for-verifiable-computation-f51d1726798f"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://medium.com/gasworks-crypto/truebit-tokenomics-13fb0b65fc67"},{"credibility":3,"name":"","type":"other","url":"https://slowmist.medium.com/26-44-million-stolen-truebit-protocol-smart-contract-vulnerability-analysis-e44fe7becd8a"},{"credibility":3,"name":"","type":"other","url":"https://tokeninsight.com/en/coins/truebittru1/tokenomics"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://slowmist.medium.com/26-44-million-stolen-truebit-protocol-smart-contract-vulnerability-analysis-e44fe7becd8a"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-truebit-hack-january-2026"},{"credibility":3,"name":"","type":"other","url":"https://thedefiant.io/news/hacks/truebit-hack-first-major-crypto-exploit-of-2026"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/26m-truebit-hack-smart-contract-vulnerability"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/markets/2026/01/09/truebit-token-tru-crashes-99-9-after-usd26-6m-exploit-drains-8-535-eth"},{"credibility":3,"name":"","type":"other","url":"https://cryptobriefing.com/truebit-hacker-launders-eth-via-tornado-cash/"},{"credibility":3,"name":"","type":"other","url":"https://www.cpomagazine.com/cyber-security/26-million-stolen-in-truebit-crypto-hack-sending-tru-token-value-to-zero/"},{"credibility":3,"name":"","type":"other","url":"https://www.panewslab.com/en/articles/b47adb56-1736-44b1-92cd-b8077327bc4a"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://people.cs.uchicago.edu/~teutsch/"},{"credibility":3,"name":"","type":"other","url":"https://truebit.io/about/"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-truebit-hack-january-2026"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://thedefiant.io/news/hacks/truebit-hack-first-major-crypto-exploit-of-2026"},{"credibility":3,"name":"","type":"other","url":"https://cryptobriefing.com/truebit-hacker-launders-eth-via-tornado-cash/"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-truebit-hack-january-2026"},{"credibility":3,"name":"","type":"other","url":"https://coinpedia.org/news/truebit-protocol-suffered-a-26-5-million-hack-as-the-tru-token-crashed-100/"}]}],"sources_used":[],"summary":"Truebit is an Ethereum-based protocol for verifiable off-chain computation, co-founded by mathematician Jason Teutsch and Solidity creator Christian Reitwiessner. On January 8, 2026, an integer overflow vulnerability in a five-year-old, closed-source legacy Purchase contract was exploited, draining 8,535 ETH (approximately $26.44 million) and causing the TRU token to collapse by over 99.9%; the attacker subsequently laundered all stolen funds through Tornado Cash.","timeline":[{"date":"2017-01-01","event":"Truebit whitepaper published by Jason Teutsch and Christian Reitwiessner, introducing the verifiable off-chain computation protocol concept for Ethereum.","source":""},{"date":"2021-01-01","event":"Truebit deploys the TRU token Purchase contract (compiled with Solidity 0.6.10) containing the undetected integer overflow vulnerability; ETH bonding curve reserves begin accumulating.","source":""},{"date":"2025-09-01","event":"Truebit announces general availability of Truebit Verify platform for tokenized asset verification and enterprise data pipelines.","source":""},{"date":"2026-01-08","event":"Attacker at address 0x6C8EC8f14bE7C01672d31CFa5f2CEfeAB2562b50 exploits integer overflow in Truebit's legacy Purchase contract, draining 8,535 ETH (~$26.44 million). TRU token collapses 99.9%+ within hours.","source":""},{"date":"2026-01-09","event":"SlowMist, Halborn, and PeckShield publish technical post-mortems. PeckShield links attacker address to the prior Sparkle Protocol exploit. Truebit team confirms law enforcement contact and contract halt.","source":""},{"date":"2026-01-10","event":"Lookonchain confirms all 8,535 ETH (approx. $26.44 million) has been deposited into Tornado Cash and laundered. Recovery prospects effectively eliminated.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 51e45eaf-da10-4b2c-929e-6236f3a25f48copy
2. #2rescoreby systemsystem

   2026-10-10 18:49:04Z
   Score: 8 → 64 (+56)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 8 → 64. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −3.2, problems around the subject, caused by others −1.6; legitimacy credit long-running +10.
   anchoranchored

   chain

   ●mainnet-betaslot 455,368,998

   sig

   5xcx9972BXan…YGKg7T3Ccopyexplorer ↗

   hash

   DgWfeweMTQPS…pWVujH71copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (637 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:49:04.177Z","decision":"rescore","investigation_id":"83bdefdc-450d-4615-80d7-d8f4b27817c1","new_score":64,"page_slug":"truebit","prev_score":8,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 8 → 64. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −3.2, problems around the subject, caused by others −1.6; legitimacy credit long-running +10.","score_delta":56,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 344979b1-c0d8-4bb9-a7aa-fc972b3cd6efcopy
3. #3acceptby agent:avoid-moderatoranalyzer

   2026-10-16 02:28:45Z
   Score: 64 → 63 (-1)
   CoinDesk confirms TRU crashed ~99.9% after an ~8,535 ETH (~$26.6M) exploit tied to a minting-function flaw allowing a zero purchase price on an unusually large buy, matching the submission.
   Source:https://www.coindesk.com/markets/2026/01/09/truebit-token-tru-crashes-99-9-after-usd26-6m-exploit-drains-8-535-eth

   Wayback:archived snapshot2026-09-21 04:57:18Z
   anchoranchored

   chain

   ●mainnet-betaslot 457,470,740

   sig

   3A9ovTEniSAz…VmZPbv54copyexplorer ↗

   hash

   Hzwv94HrbgAh…cpxVMsbPcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (654 B) ▸

   {"actor":"agent:avoid-moderator","decided_at":"2026-10-16T02:28:45.286Z","decision":"accept","investigation_id":"83bdefdc-450d-4615-80d7-d8f4b27817c1","new_score":63,"page_slug":"truebit","prev_score":64,"reason":"CoinDesk confirms TRU crashed ~99.9% after an ~8,535 ETH (~$26.6M) exploit tied to a minting-function flaw allowing a zero purchase price on an unusually large buy, matching the submission.","score_delta":-1,"sequence_num":3,"submission_content_hash":"a985d28ce70b9d889f76d8247512831d2fd2fc64e720f722c40c4c34292b2f75","submission_id":"9138b8d1-0aea-4be7-bba5-d4dfee6ede80","submission_kind":"url","submission_valence":"incriminating","v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d077b3e8-b9f0-4be9-a8d9-c942dab53975copy
4. #4reviewby reviewerreviewer

   2026-11-02 00:43:36Z
   Score: 63 → 63 (no score change)
   The core incident facts hold: January 8, 2026 exploit, 8,535 ETH, TRU down about 99.9%, Tornado Cash laundering, law enforcement contact, and the PeckShield-Sparkle link. Errors found: the Solidity version (0.5.3 per two analyses, not 0.6.10; appears three times), the victim contract mislabeled as the attack contract, and the Truebit Verify GA date (November 2025, not September). The MEV-bribe claim could not be corroborated. Founder/background claims were not checked.
   anchoranchored

   chain

   ●mainnet-betaslot 464,298,075

   sig

   huWMx24erhGs…dWmNjoDvcopyexplorer ↗

   hash

   4T2WERTL1VXM…u1D77atxcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1320 B) ▸

   {"actor":"reviewer","artifact_identity":"df876be53962a87e7972f6dc22f12104","decided_at":"2026-11-02T00:43:36.220Z","decision":"review","disputed_pct":0.5833,"findings_hash":"DivCuVWE1nUA4tEaPkcgVkbYBC6xuJbWvfRKd7eC7bTn","investigation_id":"83bdefdc-450d-4615-80d7-d8f4b27817c1","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":63,"omissions":{"material":0,"total":1},"page_content_hash":"f953c33e0c7efe0e4065b27bb58efe6d7d992f66947cabb60e4a0cbbff363245","page_slug":"truebit","prev_score":63,"reason":"The core incident facts hold: January 8, 2026 exploit, 8,535 ETH, TRU down about 99.9%, Tornado Cash laundering, law enforcement contact, and the PeckShield-Sparkle link. Errors found: the Solidity version (0.5.3 per two analyses, not 0.6.10; appears three times), the victim contract mislabeled as the attack contract, and the Truebit Verify GA date (November 2025, not September). The MEV-bribe claim could not be corroborated. Founder/background claims were not checked.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"subject_status":"exploited","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 5662f956-505a-4357-b3bf-91eeb5a61cc5copy
5. #5review reviseby judgejudge

   2026-11-02 00:43:36Z
   Score: 63 → 63 (no score change)
   Counting the review's 12 claim findings directly, 5 were disputed and 2 could not be verified (none because a source blocked access), which gives about 58% and falls in the significant-issues band. The core incident facts hold (claim_findings[0] and [1] confirmed: the January 8, 2026 exploit, 8,535 ETH drained, TRU down about 99.9%, Tornado Cash laundering). The disputes are secondary details: the victim contract is listed as the attack contract (claim_findings[2]), the Solidity version is wrong in three places (claim_findings[3] to [5], one error repeated), and the Truebit Verify launch date is wrong (claim_findings[6]). Because the disputed items are corrections to details, the founder claims were simply not checked (claim_findings[10]), and reviewer confidence is moderate (0.6), the penalty is set at the lower end of the band. The page should be corrected and the unchecked and uncorroborated claims (MEV bribes, founder background) rechecked.
   anchoranchored

   chain

   ●mainnet-betaslot 464,298,080

   sig

   5AifdnhyxGfb…mL5JKYoXcopyexplorer ↗

   hash

   CQLSAnbcGdC8…Dhv4U5qXcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1599 B) ▸

   {"actor":"judge","artifact_identity":"df876be53962a87e7972f6dc22f12104","band_override":null,"decided_at":"2026-11-02T00:43:36.220Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.5833,"investigation_id":"83bdefdc-450d-4615-80d7-d8f4b27817c1","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":63,"page_slug":"truebit","prev_score":63,"reason":"Counting the review's 12 claim findings directly, 5 were disputed and 2 could not be verified (none because a source blocked access), which gives about 58% and falls in the significant-issues band. The core incident facts hold (claim_findings[0] and [1] confirmed: the January 8, 2026 exploit, 8,535 ETH drained, TRU down about 99.9%, Tornado Cash laundering). The disputes are secondary details: the victim contract is listed as the attack contract (claim_findings[2]), the Solidity version is wrong in three places (claim_findings[3] to [5], one error repeated), and the Truebit Verify launch date is wrong (claim_findings[6]). Because the disputed items are corrections to details, the founder claims were simply not checked (claim_findings[10]), and reviewer confidence is moderate (0.6), the penalty is set at the lower end of the band. The page should be corrected and the unchecked and uncorroborated claims (MEV bribes, founder background) rechecked.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision c2275a07-f631-4db3-97ab-d83158bde070copy
6. #6rescoreby systemsystem

   2026-11-02 00:43:37Z
   Score: 63 → 68 (+5)
   Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 63 → 68. Problems weighed by who is responsible: incidents the subject suffered −3.2, concerns that are not fraud −3.2; legitimacy credit long-running +10; 3 section(s) set aside until a failed fact-check is resolved; accepted community evidence −1.4.
   anchoranchored

   chain

   ●mainnet-betaslot 464,298,084

   sig

   4JXgTmEu4oXS…srCoDTxGcopyexplorer ↗

   hash

   AWpVfTudBtSa…XoCHuA6kcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (731 B) ▸

   {"actor":"system","decided_at":"2026-11-02T00:43:36.220Z","decision":"rescore","investigation_id":"83bdefdc-450d-4615-80d7-d8f4b27817c1","new_score":68,"page_slug":"truebit","prev_score":63,"reason":"Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 63 → 68. Problems weighed by who is responsible: incidents the subject suffered −3.2, concerns that are not fraud −3.2; legitimacy credit long-running +10; 3 section(s) set aside until a failed fact-check is resolved; accepted community evidence −1.4.","score_delta":5,"score_model":"v2","sequence_num":6,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 29d8073b-e6b6-44af-8f43-9df81242129dcopy