Audit log

Every state-changing event for uniBTC: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-28 03:28:42Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,638,459

   sig

   2kDdAxnczxm3…6qwDHeUpcopyexplorer ↗

   hash

   Jfvm3mfnou3t…xZwpXhzicopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (7811 B) ▸

   {"actor":"system:backfill","investigation_id":"23c26d79-a5d9-43f7-900e-e60000503ba6","kind":"publish","page_slug":"unibtc","published_at":"2026-05-28T03:28:42.112Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"uniBTC","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://docs.bedrock.technology/multi-asset-liquid-staking/unibtc/introduction","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/bedrock-unibtc","type":"other","url":""},{"credibility":3,"name":"https://etherscan.io/token/0x004e9c3ef86bc1ca1f0bb5c7662861ee93350568","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://dedaub.com/blog/bedrock-vulnerability-disclosure-and-actions/","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/liquid-restaking-protocol-bedrock-suffers-2-million-exploit","type":"other","url":""},{"credibility":3,"name":"https://thedefiant.io/news/hacks/bedrock-vulnerability-allows-hacker-to-drain-usd2m-from-unibtc-liquidity-pools","type":"other","url":""},{"credibility":3,"name":"https://www.quillaudits.com/blog/hack-analysis/bedrock-2million-exploit","type":"other","url":""},{"credibility":3,"name":"https://blockapex.io/unibtc-hack-analysis/","type":"other","url":""},{"credibility":3,"name":"https://lunaray.medium.com/bedrock-unibtc-hack-analysis-7808902e5a7c","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cointelegraph.com/news/fuzzland-ex-employee-bedrock-unibtc-exploit","type":"other","url":""},{"credibility":3,"name":"https://cryptonews.com/news/ex-employee-hacks-bedrock-unibtc-for-2m-fuzzland-uncovers-insider-exploit/","type":"other","url":""},{"credibility":3,"name":"https://www.bitdegree.org/crypto/news/fuzzland-breach-tied-to-ex-employee-in-2-million-unibtc-exploit","type":"other","url":""},{"credibility":3,"name":"https://news.shib.io/2025/06/26/fuzzland-reveals-insider-behind-2m-unibtc-hack-at-bedrock/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://docs.bedrock.technology/security/audit-reports","type":"other","url":""},{"credibility":3,"name":"https://dedaub.com/blog/bedrock-vulnerability-disclosure-and-actions/","type":"other","url":""},{"credibility":3,"name":"https://www.quillaudits.com/blog/hack-analysis/bedrock-2million-exploit","type":"other","url":""},{"credibility":3,"name":"https://www.fxleaders.com/news/2024/09/29/bedrock-boosts-security-after-2m-exploit-with-chainlink-integration-and-audits/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://x.com/Bedrock_DeFi/status/1839712719630676051","type":"other","url":""},{"credibility":3,"name":"https://blockonomi.com/bedrock-protocol-reports-2m-exploit-reimbursement-plan-in-progress/","type":"other","url":""},{"credibility":3,"name":"https://chainlinktoday.com/after-2-million-exploit-bedrock-turns-to-chainlink-proof-of-reserve-for-secure-minting/","type":"other","url":""},{"credibility":3,"name":"https://cryptobriefing.com/bedrock-chainlink-integration-security/","type":"other","url":""},{"credibility":3,"name":"https://beincrypto.com/bedrock-integrates-chainlink-2-million-exploit/","type":"other","url":""},{"credibility":3,"name":"https://www.prnewswire.com/news-releases/bedrock-launches-unibtc-and-brbtc-on-aptos-expanding-the-frontiers-of-btcfi-302546744.html","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cryptonews.net/news/security/29852647/","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2024/09/27/bedrock-faces-2-million-loss-in-unibtc-security-breach/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cointelegraph.com/news/fuzzland-ex-employee-bedrock-unibtc-exploit","type":"other","url":""},{"credibility":3,"name":"https://cryptonews.com/news/ex-employee-hacks-bedrock-unibtc-for-2m-fuzzland-uncovers-insider-exploit/","type":"other","url":""}]}],"sources_used":[],"summary":"uniBTC is a synthetic Bitcoin liquid restaking token issued by Bedrock protocol, enabling wBTC holders to earn BTC-native yield via the Babylon staking protocol while retaining liquidity. In September 2024, a critical minting vulnerability in multiple uniBTC vault smart contracts across eight blockchains was exploited for approximately $2 million after a third-party security firm disclosed the flaw hours before the attack. Post-incident forensics by Fuzzland, disclosed in June 2025, attributed the exploit to an insider threat — a former employee who embedded malware into Fuzzland's internal codebase and used privileged access to execute the attack; Bedrock has since integrated Chainlink Proof of Reserve and expanded to multiple new chains.","timeline":[{"date":"2024-06-12","event":"Blocksec conducts initial audit of uniBTC contracts.","source":""},{"date":"2024-09-04","event":"Alleged insider (later identified as a former Fuzzland employee) modifies Cargo.toml to include malicious Rust crate 'rands', embedding malware in Fuzzland workstations.","source":""},{"date":"2024-09-25","event":"Vulnerable uniBTC vault contract deployed approximately 36 hours before the exploit.","source":""},{"date":"2024-09-26","event":"16:00 UTC — Dedaub discovers and confirms the critical infinite-mint vulnerability in uniBTC vault contracts across 8 chains.","source":""},{"date":"2024-09-26","event":"16:27 UTC — Dedaub reports vulnerability to Bedrock via Twitter. 16:41 UTC — SEAL 911 war room created.","source":""},{"date":"2024-09-26","event":"Emergency call held between Fuzzland and relevant parties to discuss the Dedaub-identified vulnerability. Insider with privileged access participates.","source":""},{"date":"2024-09-26","event":"18:28 UTC — First exploit transaction executes on Ethereum. Attacker mints ~30.8 uniBTC, swaps to WBTC via Uniswap, converts to ~680 WETH, nets ~649.6 WETH (~$1.7M) after repaying flash loan.","source":""},{"date":"2024-09-26","event":"Bedrock coordinates with Pendle Finance to disable uniBTC exposure, protecting over $30M in liquidity. Vulnerable vaults paused across 8 chains.","source":""},{"date":"2024-09-27","event":"Bedrock publicly acknowledges exploit. Estimates total losses at approximately $2 million, primarily in DEX liquidity pools. Announces reimbursement plan.","source":""},{"date":"2024-09-27","event":"Stolen funds routed through Tornado Cash mixing service.","source":""},{"date":"2024-09-28","event":"Bedrock publishes post-mortem report via X (@Bedrock_DeFi). Extends job offer to attacker; no response publicly reported.","source":""},{"date":"2024-09-29","event":"Bedrock announces Chainlink Proof of Reserve Secure Mint integration as primary security remediation. PeckShield conducts post-incident audit (completed October 1, 2024). Blocksec conducts second audit (completed October 30, 2024).","source":""},{"date":"2025-02-05","event":"Bedrock contributes approximately 1,000 uniBTC to Berachain's Boyco campaign; Boyco TVL reaches $3 billion.","source":""},{"date":"2025-06-26","event":"Fuzzland publishes transparency report disclosing that a former employee was behind the September 2024 exploit using supply chain malware, social engineering, and privileged access. Fuzzland accepts full responsibility and states all affected parties were reimbursed.","source":""},{"date":"2025-09-04","event":"Bedrock launches uniBTC and brBTC on the Aptos blockchain, reporting nearly $700M in TVL and over 5,000 BTC staked across 15+ chains.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision e0159de9-c0b7-42f9-8879-15361935abfbcopy
2. #2rescoreby systemsystem

   2026-10-10 18:44:43Z
   Score: 32 → 54 (+22)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 32 → 54. Problems weighed by who is responsible: incidents the subject suffered −6.4, problems around the subject, caused by others −3.2, concerns that are not fraud −3.2; legitimacy credit long-running +2.
   anchoranchored

   chain

   ●mainnet-betaslot 455,364,449

   sig

   2YZeTLZZDujY…DHV2URT2copyexplorer ↗

   hash

   CDtmvboe72aT…SugtZg1Xcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (637 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:44:43.730Z","decision":"rescore","investigation_id":"23c26d79-a5d9-43f7-900e-e60000503ba6","new_score":54,"page_slug":"unibtc","prev_score":32,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 32 → 54. Problems weighed by who is responsible: incidents the subject suffered −6.4, problems around the subject, caused by others −3.2, concerns that are not fraud −3.2; legitimacy credit long-running +2.","score_delta":22,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ae910b51-5746-44c1-b797-13b86d8caf68copy
3. #3reviewby reviewerreviewer

   2026-11-03 23:35:06Z
   Score: 54 → 54 (no score change)
   The core exploit narrative (Dedaub disclosure timeline, about $2M loss, Pendle mitigation, Fuzzland insider attribution) matches the sources I read. The ZachXBT section is wrong: its source ties his treasury multisig findings to Truflation, not Bedrock. The Tornado Cash claim, the 'rands' crate detail and the audit dates were not verified, and one archive link points to an unrelated article. Only a small sample of claims was checked.
   anchoranchored

   chain

   ●mainnet-betaslot 465,085,387

   sig

   65y3VzsyxoW2…m1hibLeMcopyexplorer ↗

   hash

   9EFE2x8z2FRE…Xxaap3dzcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1246 B) ▸

   {"actor":"reviewer","artifact_identity":"58b339de4fff34071e8963dcbd806265","decided_at":"2026-11-03T23:35:06.147Z","decision":"review","disputed_pct":0.5714,"findings_hash":"GN8CmEiDWuoFrRruPhMZC3jHgwuLjsoVEM1C9Sh3GW9Q","investigation_id":"23c26d79-a5d9-43f7-900e-e60000503ba6","judge_def_hash":"750934ecb48272224909b7430fab271676d391380fbc821acbe7ee7e4cac2fa3","new_score":54,"page_content_hash":"8fa38089e28527b0afb07b15474b926ccc7ed222170a6995b3a01df33af23f77","page_slug":"unibtc","prev_score":54,"reason":"The core exploit narrative (Dedaub disclosure timeline, about $2M loss, Pendle mitigation, Fuzzland insider attribution) matches the sources I read. The ZachXBT section is wrong: its source ties his treasury multisig findings to Truflation, not Bedrock. The Tornado Cash claim, the 'rands' crate detail and the audit dates were not verified, and one archive link points to an unrelated article. Only a small sample of claims was checked.","reviewer_def_hash":"3839668b232611e5b26db72079d64745f8e57e919b8a379e79b44ba4a52c845b","score_delta":0,"sequence_num":3,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ada7fc69-ecef-433f-9909-e6bcc4c0a3bbcopy
4. #4review reviseby judgejudge

   2026-11-03 23:35:06Z
   Score: 54 → 54 (no score change)
   Of 7 claims checked, 2 were disputed and 2 could not be verified (none were blocked by the source), giving 57%, which falls in the significant-issues band. claim_findings[0] and [1] show the ZachXBT section attributes Truflation findings to the Bedrock exploit, and claim_findings[3] and [6] (Tornado Cash routing, a mismatched archive link) are unverified. The core exploit narrative (Dedaub timeline, about $2M loss, Fuzzland insider attribution) matched sources, and the reviewer's confidence is 0.5 on a small sample, so the penalty is kept in the lower half of the band and the page is not denied.
   anchoranchored

   chain

   ●mainnet-betaslot 465,085,393

   sig

   2eLK3NyGdUX6…XMeNLU91copyexplorer ↗

   hash

   9sNDZ794WkYC…ysm9oLsFcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1242 B) ▸

   {"actor":"judge","artifact_identity":"58b339de4fff34071e8963dcbd806265","band_override":null,"decided_at":"2026-11-03T23:35:06.147Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.5714,"investigation_id":"23c26d79-a5d9-43f7-900e-e60000503ba6","judge_def_hash":"750934ecb48272224909b7430fab271676d391380fbc821acbe7ee7e4cac2fa3","new_score":54,"page_slug":"unibtc","prev_score":54,"reason":"Of 7 claims checked, 2 were disputed and 2 could not be verified (none were blocked by the source), giving 57%, which falls in the significant-issues band. claim_findings[0] and [1] show the ZachXBT section attributes Truflation findings to the Bedrock exploit, and claim_findings[3] and [6] (Tornado Cash routing, a mismatched archive link) are unverified. The core exploit narrative (Dedaub timeline, about $2M loss, Fuzzland insider attribution) matched sources, and the reviewer's confidence is 0.5 on a small sample, so the penalty is kept in the lower half of the band and the page is not denied.","reviewer_def_hash":"3839668b232611e5b26db72079d64745f8e57e919b8a379e79b44ba4a52c845b","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision a1eb1f43-bf02-423b-840f-319d526320fccopy
5. #5rescoreby systemsystem

   2026-11-03 23:35:07Z
   Score: 54 → 55 (+1)
   Recalculated after the fact-check of 2026-11-03. Rescored under Scoring v2, the published formula (avoid.net/scoring): 54 → 55. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −3.2, problems around the subject, caused by others −2.4; legitimacy credit long-running +2; 1 section(s) set aside until a failed fact-check is resolved.
   anchoranchored

   chain

   ●mainnet-betaslot 465,085,398

   sig

   63zJZTx5Tk3h…x9vf9KKmcopyexplorer ↗

   hash

   AyRWEVozDtyy…XE5wfBGScopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (747 B) ▸

   {"actor":"system","decided_at":"2026-11-03T23:35:06.147Z","decision":"rescore","investigation_id":"23c26d79-a5d9-43f7-900e-e60000503ba6","new_score":55,"page_slug":"unibtc","prev_score":54,"reason":"Recalculated after the fact-check of 2026-11-03. Rescored under Scoring v2, the published formula (avoid.net/scoring): 54 → 55. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −3.2, problems around the subject, caused by others −2.4; legitimacy credit long-running +2; 1 section(s) set aside until a failed fact-check is resolved.","score_delta":1,"score_model":"v2","sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 673d862a-ee9f-4173-8996-5dba20f53e2ecopy