Verify a decision
Every moderation decision on AVOID.NET is anchored to the Solana blockchain. You don't have to trust us — you can verify cryptographically that we committed to a verdict at a specific moment and have not rewritten it.
How verification works
- We commit. When a moderator accepts/rejects a submission, we serialize the decision into deterministic UTF-8 bytes (
payload_canonical_string), hash it with SHA-256, encode the digest as base58, and write it to Solana inside an SPL Memo v2 transaction. - We store the bytes. The exact bytes we hashed are stored alongside the decision in our database. Anyone can read them and recompute the hash in any language.
- You compare three values. Database hash, your independently-recomputed hash, and the hash inside the on-chain memo. If all three match, the decision is authentic and timestamped.
The on-chain memo format is
AVOID.NET|v1|h:<b58-sha256>|d:<id>|t:<iso>Find a signature on any investigation page's decision log, or run python -m src.verify_decision --signature <sig> for a CLI check.
Decision
review · AudiA6
- Sequence
- #5
- Score
- 0 → 0 (0)
- Cluster
- mainnet-beta
- Slot
- 457902775
- Off-chain at
- 2026-10-17T04:24:34.896Z
- Anchored at
- 2026-10-17T04:25:05.785Z
- Block time
- —
Independent verification
- 1. Database (off-chain)
- Htd5Ne8cjwjyhxN2aAPsHT52KJJndFTmDK2UiFWFwogP
- 2. Recomputed (your browser)
- computing…
- 3. On-chain (Solana memo)
- fetching…
Canonical bytes hashed (2140 chars)
{"actor":"reviewer","artifact_identity":"cbc3dcbac11d1dd9ebf3e6f9935b6980","decided_at":"2026-10-17T04:24:34.722Z","decision":"review","disputed_pct":0.1154,"findings_hash":"9LKE1fbk5oW4Q7WAqhW2tBangP66sQiNRBt8jPvAjgMg","investigation_id":"ea89f009-d5f5-4c59-9b8e-d7cd672c067a","mode":"findings_only","new_score":0,"page_content_hash":"10792602da3d1f70fc809b59a9724755fc063b169ae01986ca7a97135dcd668b","page_slug":"audia6","prev_score":0,"reason":"The page is substantially well-sourced: the headline figures (10,333 BTC / ~$389M, 3-10% commissions, the two defendants' names/ages/nationalities, the Batumi arrests, EDPA charges, the June 10-11 2026 takedown, the TRM Labs ransomware-group breakdown, the LastPass/Wasabi Wallet trace, and the seizure statistics) all check out against DOJ/IRS, Europol-linked press coverage, and TRM Labs' own blog post, all of which remain live (no link rot found across the sampled sources). The most serious problem is a misattributed quote: the page has an operator saying 'don't care' in response to a question about laundering cocaine proceeds, when the cited source shows 'don't care' was said about a different exchange (stolen bitcoin), and the cocaine-proceeds exchange actually elicited a different line ('Everything like that needs to go through a mixer'). There is also a timeline entry (2026-06-13, extradition confirmation) that is not supported by its own cited source, which places that statement on June 11 instead, appearing to duplicate an existing timeline entry under a wrong date. A parenthetical vehicle count ('173 across all jurisdictions') invents a scope not present in the source it is implicitly drawn from. Minor overstatements include calling Exploit and Verified 'darknet marketplaces' (TRM calls them cybercrime platforms) and calling 15+ TRM-linked investigations 'active.' None of these affect the page's core, well-supported narrative that AudiA6 was a real, large-scale, now-dismantled mixing service used by ransomware actors.","score_delta":0,"sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}