Audit log

Every state-changing event for UPCX: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-28 20:25:00Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,792,435

   sig

   4hLk8jUvw4i2…qJynbYnVcopyexplorer ↗

   hash

   9jxz8Togm5LV…SH2mSw6Ccopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (4139 B) ▸

   {"actor":"system:backfill","investigation_id":"92255638-c0e0-4934-b6c1-4fba5bd21afc","kind":"publish","page_slug":"upcx","published_at":"2026-05-28T20:25:00.853Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"UPCX","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.globenewswire.com/news-release/2025/03/21/3047070/0/en/UPCX-From-Japanese-Compliance-to-Global-Expansion.html","type":"other","url":""},{"credibility":3,"name":"https://www.globenewswire.com/news-release/2025/03/17/3043770/0/en/UPCX-UPC-to-Launch-on-Japanese-Crypto-Trading-Platform-BitTrade.html","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-upcx-hack-april-2025","type":"other","url":""},{"credibility":3,"name":"https://cryptoslate.com/upcx-halts-transactions-after-70-million-hack-exposes-vulnerabilities/","type":"other","url":""},{"credibility":3,"name":"https://coinjournal.net/news/blockchain-payments-platform-upcx-exploited-for-70m/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-upcx-hack-april-2025","type":"other","url":""},{"credibility":3,"name":"https://skynet.certik.com/projects/upcx","type":"other","url":""},{"credibility":3,"name":"https://blog.ueex.com/crypto-hacks/upcx-hack/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.globenewswire.com/news-release/2025/03/17/3043770/0/en/UPCX-UPC-to-Launch-on-Japanese-Crypto-Trading-Platform-BitTrade.html","type":"other","url":""},{"credibility":3,"name":"https://coinmarketcap.com/academy/article/hacker-steals-dollar70-million-in-upc-tokens-after-gaining-control-of-upcx-smart-contract","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.globenewswire.com/news-release/2025/03/21/3047070/0/en/UPCX-From-Japanese-Compliance-to-Global-Expansion.html","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.globenewswire.com/news-release/2025/07/15/3115534/0/en/UPCX-Staking-Surpasses-975-000-Tokens-as-Web3-Payment-Ecosystem-Accelerates-Expansion.html","type":"other","url":""},{"credibility":3,"name":"https://finance.yahoo.com/news/hacker-steals-70-million-upc-214926542.html","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://skynet.certik.com/projects/upcx","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-upcx-hack-april-2025","type":"other","url":""}]}],"sources_used":[],"summary":"UPCX is a blockchain payment protocol that suffered a $70 million exploit on April 1, 2025, when an attacker compromised an administrative private key and used it to push a malicious smart contract upgrade, draining 18.4 million UPC tokens from management accounts. The attack was enabled by the absence of multisig controls on privileged protocol functions, despite having undergone CertiK and Cyberscope audits that did not catch the operational key management risk. Despite listing on a Japanese FSA-licensed exchange just 11 days prior, no recovery of stolen funds was reported.","timeline":[{"date":"2025-03-17","event":"UPCX announces listing on BitTrade, a Japanese FSA-licensed exchange.","source":""},{"date":"2025-03-27","event":"UPCX UPC token goes live on BitTrade exchange in Japan.","source":""},{"date":"2025-04-01","event":"Attacker compromises admin private key, pushes malicious ProxyAdmin upgrade, drains ~18.4M UPC (~$70M) from three management accounts.","source":""},{"date":"2025-04-01","event":"Cyvers detects the exploit; UPCX halts all transactions and announces investigation.","source":""},{"date":"2025-07-15","event":"UPCX press release reports staking activity resuming, surpassing 975,000 tokens. Stolen funds unrecovered.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision b40d9441-bde8-485f-acee-c82086b8cb9dcopy
2. #2reviewby reviewerreviewer

   2026-11-02 04:15:33Z
   Score: 28 → 28 (no score change)
   The core hack facts (April 1, 2025, 18.4M UPC, ~$70M, ProxyAdmin upgrade, Cyvers detection) are well supported. The page miscounts the gap between the BitTrade listing and the hack as 11 days when it was 5, in two places. The ZachXBT flag and the pre-hack CertiK/Cyberscope audits could not be verified, and the 'entirely' multisig causation overstates Halborn's hedged analysis. Several cited sources (GlobeNewswire) blocked fetching.
   anchoranchored

   chain

   ●mainnet-betaslot 464,357,323

   sig

   4TUQSNYumft7…XsNQiMtmcopyexplorer ↗

   hash

   5dgFuNXeTgwS…42j5YKfdcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1316 B) ▸

   {"actor":"reviewer","artifact_identity":"d6c1ed8ef6b2026faddfbb3e0dd95d0b","blocked_count":1,"decided_at":"2026-11-02T04:15:32.974Z","decision":"review","disputed_pct":0.4545,"findings_hash":"28PavWy525f8jC8Jk8r6guk46rTmFQyFCWoZRKvg6z1D","investigation_id":"92255638-c0e0-4934-b6c1-4fba5bd21afc","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":28,"omissions":{"material":0,"total":1},"page_content_hash":"c5f75ae34287220dfa9918fc11b5f5202ee0d681ac747f9a40beaec14e8b774f","page_slug":"upcx","prev_score":28,"reason":"The core hack facts (April 1, 2025, 18.4M UPC, ~$70M, ProxyAdmin upgrade, Cyvers detection) are well supported. The page miscounts the gap between the BitTrade listing and the hack as 11 days when it was 5, in two places. The ZachXBT flag and the pre-hack CertiK/Cyberscope audits could not be verified, and the 'entirely' multisig causation overstates Halborn's hedged analysis. Several cited sources (GlobeNewswire) blocked fetching.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":11,"sequence_num":2,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 8d328d33-b5af-45a1-b101-32a4e3ab2940copy
3. #3review reviseby judgejudge

   2026-11-02 04:15:33Z
   Score: 28 → 10 (-18)
   The core incident (April 1, 2025 exploit, about 18.4M UPC, about $70M, malicious ProxyAdmin upgrade, detection by Cyvers) is confirmed by Tier 2 sources (claim_findings[0], [5], [6]). However, 5 of 11 scored claims (about 45%, excluding one claim whose source blocked the reviewer) were disputed or unverifiable: the gap between the BitTrade listing and the hack is stated as 11 days when the page's own dates give 5 (claim_findings[1], [2]), and the ZachXBT flag, the pre-hack CertiK and Cyberscope audits, and the absence of a bounty could not be verified (claim_findings[4], [7], [8]). The 'entirely' multisig causation also overstates a hedged source (claim_findings[3]). Because the central allegation holds and reviewer confidence is moderate, the penalty sits in the lower part of the significant band.
   anchoranchored

   chain

   ●mainnet-betaslot 464,357,329

   sig

   4UXwQSH7ADah…qe2rdmQJcopyexplorer ↗

   hash

   BvQjLzBGf9hU…nuZirVpEcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1591 B) ▸

   {"actor":"judge","artifact_identity":"d6c1ed8ef6b2026faddfbb3e0dd95d0b","band_override":null,"blocked_count":1,"decided_at":"2026-11-02T04:15:32.974Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.4545,"investigation_id":"92255638-c0e0-4934-b6c1-4fba5bd21afc","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":10,"page_slug":"upcx","prev_score":28,"reason":"The core incident (April 1, 2025 exploit, about 18.4M UPC, about $70M, malicious ProxyAdmin upgrade, detection by Cyvers) is confirmed by Tier 2 sources (claim_findings[0], [5], [6]). However, 5 of 11 scored claims (about 45%, excluding one claim whose source blocked the reviewer) were disputed or unverifiable: the gap between the BitTrade listing and the hack is stated as 11 days when the page's own dates give 5 (claim_findings[1], [2]), and the ZachXBT flag, the pre-hack CertiK and Cyberscope audits, and the absence of a bounty could not be verified (claim_findings[4], [7], [8]). The 'entirely' multisig causation also overstates a hedged source (claim_findings[3]). Because the central allegation holds and reviewer confidence is moderate, the penalty sits in the lower part of the significant band.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":-18,"score_limit":{"applied":-18,"limited":false,"proposed":-18,"rule":"second_opinion_agreed","second":-18},"scored_claims":11,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision b73a6680-bd96-4fc1-970c-c635dc3a25b6copy