Verify a decision
Every moderation decision on AVOID.NET is anchored to the Solana blockchain. You don't have to trust us — you can verify cryptographically that we committed to a verdict at a specific moment and have not rewritten it.
How verification works
- We commit. When a moderator accepts/rejects a submission, we serialize the decision into deterministic UTF-8 bytes (
payload_canonical_string), hash it with SHA-256, encode the digest as base58, and write it to Solana inside an SPL Memo v2 transaction. - We store the bytes. The exact bytes we hashed are stored alongside the decision in our database. Anyone can read them and recompute the hash in any language.
- You compare three values. Database hash, your independently-recomputed hash, and the hash inside the on-chain memo. If all three match, the decision is authentic and timestamped.
The on-chain memo format is
AVOID.NET|v1|h:<b58-sha256>|d:<id>|t:<iso>Find a signature on any investigation page's decision log, or run python -m src.verify_decision --signature <sig> for a CLI check.
Decision
review · Bitrefill
- Sequence
- #6
- Score
- 52 → 52 (0)
- Cluster
- mainnet-beta
- Slot
- 457525318
- Off-chain at
- 2026-10-16T05:45:06.930Z
- Anchored at
- 2026-10-16T05:45:28.320Z
- Block time
- —
Independent verification
- 1. Database (off-chain)
- 975DYPugEfyw19ZfRCGKVx2Khdjgb7Jrm1K5Nb6qcan5
- 2. Recomputed (your browser)
- computing…
- 3. On-chain (Solana memo)
- fetching…
Canonical bytes hashed (1993 chars)
{"actor":"reviewer","artifact_identity":"0a58be417d7404c34c73d283bdbca524","decided_at":"2026-10-16T05:45:06.668Z","decision":"review","disputed_pct":0.0526,"findings_hash":"JCQ56UJdKSFYyxvrGrWvKC2ZKtYDS9aZTcKjQHYfxp1R","investigation_id":"8038ecc2-39f1-4530-bfdf-f87bf4b49de2","mode":"findings_only","new_score":52,"page_content_hash":"881751ee9aba6cbeb746dd44fb93863ee4e63c92e1c609e721e7137edbeb6a07","page_slug":"bitrefill","prev_score":52,"reason":"The page's core factual narrative — the March 1, 2026 breach, the ~18,500 exposed purchase records, the employee-laptop/legacy-credential attack vector, the Lazarus Group/Bluenoroff attribution and its stated basis, the March 17-18 disclosure timeline, the named security firms, and the broader $577M/76% DPRK crypto-theft statistic — is well supported by multiple independent tier-1 and tier-2 outlets (CoinDesk, The Block, SC Media) that corroborate Bitrefill's own public statements in detail. The page is also appropriately hedged where attribution is unconfirmed by any government body. The main weaknesses found are: (1) the four-name founder list (Kotliar, Stiller, Gustavsson, Grünberger) in the Company Overview and timeline does not match any single source consulted, including Bitrefill's own blog, which names only three different co-founders without Patric Stiller — flagged as partially_supported; and (2) two low-value cited sources (a dev.to blog post and databreach.io) are currently dead links, though neither carries unique factual weight since their claims are independently corroborated elsewhere on the page. No disputed or stale claims were identified. Coverage gaps exist around independent forensic confirmation of attribution, on-chain fund tracing, and Bitrefill's broader AML/regulatory risk profile as a no-KYC platform, none of which are addressed by the current page.","score_delta":0,"sequence_num":6,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}