Audit log

Every state-changing event for Volo Vault: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-26 18:30:19Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,338,834

   sig

   4GPruZK4SkHd…ZrDBEcjocopyexplorer ↗

   hash

   2jdyQk6CQpU3…cenq8Czwcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (5608 B) ▸

   {"actor":"system:backfill","investigation_id":"7b231e4d-87b8-4e9b-a6ab-480fa5c4a1dd","kind":"publish","page_slug":"volo-vault","published_at":"2026-05-26T18:30:19.312Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Volo Vault","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://news.bitcoin.com/volo-protocol-loses-3-5-million-in-sui-blockchain-exploit-blocks-wbtc-bridge-attempt/","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/volo-defi-3-5m-exploit-vault-attack-recovery","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/markets/2026/04/22/another-defi-protocol-loses-millions-in-hack-days-after-kelpdao-breach","type":"other","url":""},{"credibility":3,"name":"https://www.banklesstimes.com/articles/2026/04/22/volo-protocol-confirms-3-5m-sui-vault-exploit-500k-already-frozen/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://phemex.com/news/article/volo-recovers-90-of-stolen-funds-after-35m-exploit-76447","type":"other","url":""},{"credibility":3,"name":"https://themarketperiodical.com/2026/04/23/crypto-hack-volo-recovers-2m-of-exploited-funds/","type":"other","url":""},{"credibility":3,"name":"https://thecurrencyanalytics.com/stable-coins/volo-protocol-loses-3-5-million-in-vault-exploit-team-pledges-full-user-reimbursement-254311","type":"other","url":""},{"credibility":3,"name":"https://finance.yahoo.com/markets/crypto/articles/sui-crypto-defi-protocol-volo-154550226.html","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://news.bitcoin.com/volo-protocol-loses-3-5-million-in-sui-blockchain-exploit-blocks-wbtc-bridge-attempt/","type":"other","url":""},{"credibility":3,"name":"https://www.cryptobreaking.com/volo-exploit-raises-security-concerns/","type":"other","url":""},{"credibility":3,"name":"https://cryptorank.io/news/feed/63a0c-volo-protocol-sui-exploit-details","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://news.bitcoin.com/volo-protocol-loses-3-5-million-in-sui-blockchain-exploit-blocks-wbtc-bridge-attempt/","type":"other","url":""},{"credibility":3,"name":"https://veridise.com/wp-content/uploads/2025/11/VAR-NAVI-250523-SUI-VOLO-VAULT-V3.pdf","type":"other","url":""},{"credibility":3,"name":"https://medium.com/@navi.protocol/navi-protocol-acquires-liquid-staking-protocol-volo-55ca7925f7c9","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://medium.com/@navi.protocol/navi-protocol-acquires-liquid-staking-protocol-volo-55ca7925f7c9","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/volo","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/markets/2026/04/22/another-defi-protocol-loses-millions-in-hack-days-after-kelpdao-breach","type":"other","url":""},{"credibility":3,"name":"https://www.cryptobreaking.com/volo-exploit-raises-security-concerns/","type":"other","url":""},{"credibility":3,"name":"https://ambcrypto.com/volo-protocol-suffers-3-5-mln-exploit-in-aprils-third-crypto-hacking-incident/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[]}],"sources_used":[],"summary":"Volo Vault is a yield-generating vault product operated by Volo Protocol, a BTCFi and liquid staking platform built on the Sui blockchain. In April 2026, three of its vaults were exploited via a compromised admin private key, resulting in approximately $3.5 million in losses across WBTC, XAUm, and USDC holdings. The team committed to absorbing all user losses and ultimately recovered approximately 90% of the stolen funds through coordination with the Sui Foundation, ZachXBT, and ecosystem partners.","timeline":[{"date":"2024-01-17","event":"NAVI Protocol announces acquisition of Volo liquid staking protocol; Volo TVL at $7.45 million at time of announcement.","source":""},{"date":"2025-08-07","event":"Volo launches BTC Vaults, enabling users to earn yield on wrapped Bitcoin (wBTC) on Sui.","source":""},{"date":"2025-11-01","event":"Veridise completes formal audit of NAVI-Volo Vault v3 smart contracts (VAR-NAVI-250523-SUI-VOLO-VAULT-V3).","source":""},{"date":"2026-04-21","event":"Attacker uses compromised admin private key to invoke privileged withdrawal function, draining three Volo Vaults of approximately $3.5 million in WBTC, XAUm, and USDC. Attacker address: 0xe76970bbf9b038974f6086009799772db5190f249ce7d065a581b1ac0adaef75.","source":""},{"date":"2026-04-22","event":"Volo freezes all vaults and publicly confirms the exploit. Approximately $500,000 frozen within 30 minutes. Team notifies Sui Foundation and engages ZachXBT and ecosystem partners. Team commits to absorbing all user losses.","source":""},{"date":"2026-04-22","event":"Volo successfully blocks attacker's attempt to bridge out 19.6 WBTC (approximately $2.1 million); funds held by cooperating platforms.","source":""},{"date":"2026-04-22","event":"GoPlus Security and ExVul publish analysis attributing root cause to social-engineering-based admin key compromise, not smart contract vulnerability.","source":""},{"date":"2026-04-27","event":"Volo reports approximately 90% of stolen funds recovered or frozen; net loss estimated at approximately $200,000. Full user compensation pledged from Treasury.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 961827d0-ef0e-4ba5-8d32-cb6a53fcda56copy
2. #2rescoreby systemsystem

   2026-10-10 18:46:15Z
   Score: 38 → 59 (+21)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 38 → 59. Problems weighed by who is responsible: problems around the subject, caused by others −4, incidents the subject suffered −3.2, concerns that are not fraud −3.2; legitimacy credit long-running +4.
   anchoranchored

   chain

   ●mainnet-betaslot 455,365,989

   sig

   4cqHbrmWLS4v…QxQSpumqcopyexplorer ↗

   hash

   E3jcNb9hw4QR…qSkbiGyUcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (639 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:46:15.569Z","decision":"rescore","investigation_id":"7b231e4d-87b8-4e9b-a6ab-480fa5c4a1dd","new_score":59,"page_slug":"volo-vault","prev_score":38,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 38 → 59. Problems weighed by who is responsible: problems around the subject, caused by others −4, incidents the subject suffered −3.2, concerns that are not fraud −3.2; legitimacy credit long-running +4.","score_delta":21,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 50b89736-3e81-463d-a5fc-91844e52a4c7copy
3. #3reviewby reviewerreviewer

   2026-11-02 03:31:44Z
   Score: 59 → 59 (no score change)
   The core incident facts hold up against the sources I fetched: $3.5M lost across three vaults, a compromised admin key, the attacker address, the function name, the blocked 19.6 WBTC bridge and the roughly 90% recovery. The net loss figure of about $200K has been superseded by later reporting of about $60K. The ZachXBT claim was not found in the cited source, and the post-mortem and regulatory claims cannot be confirmed. The corporate-history, TVL and broader-context claims were not checked.
   anchoranchored

   chain

   ●mainnet-betaslot 464,345,120

   sig

   4QoSJWJCSsLR…51weFCAxcopyexplorer ↗

   hash

   HVhzZM8CTrCQ…bTJXP8q2copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1343 B) ▸

   {"actor":"reviewer","artifact_identity":"cc435d7a1a11a5f982e891e828fde527","decided_at":"2026-11-02T03:31:44.807Z","decision":"review","disputed_pct":0.5,"findings_hash":"CJhNpg4YRoo26TPTbxSvvEEEGZXoXQBbEgVViuCfbNrg","investigation_id":"7b231e4d-87b8-4e9b-a6ab-480fa5c4a1dd","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":59,"omissions":{"material":1,"total":3},"page_content_hash":"a8ebb13b28f906b0e8ac156a03fb7eaa78d78d042cec0e430fdbe2410e88c36c","page_slug":"volo-vault","prev_score":59,"reason":"The core incident facts hold up against the sources I fetched: $3.5M lost across three vaults, a compromised admin key, the attacker address, the function name, the blocked 19.6 WBTC bridge and the roughly 90% recovery. The net loss figure of about $200K has been superseded by later reporting of about $60K. The ZachXBT claim was not found in the cited source, and the post-mortem and regulatory claims cannot be confirmed. The corporate-history, TVL and broader-context claims were not checked.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":3,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 308b336d-f371-4aa4-9e9e-1eefd750cd49copy
4. #4review reviseby judgejudge

   2026-11-02 03:31:45Z
   Score: 59 → 59 (no score change)
   The core incident facts hold up: the $3.5M loss across three vaults, the compromised admin key, the attacker address, the function name and the auditor list are confirmed (claim_findings[0], [1], [7]). Five of ten claims could not be verified (50%), which puts the page in the significant-issues band. Most of those are untested absence claims or unfetched sources, not contradictions, and the reviewer's confidence is only 0.5, so the penalty sits at the lower end of the band. The page is stale on the net loss figure (claim_findings[3], omission_findings[0]), the ZachXBT claim was not found in the cited source (claim_findings[2]), and the Veridise audit date is uncertain (claim_findings[6]). No disputed findings, shutdown or sanction were reported.
   anchoranchored

   chain

   ●mainnet-betaslot 464,345,125

   sig

   3EAnY2vrC11a…fG9WdvsMcopyexplorer ↗

   hash

   EFii2RovMD6H…Zs8ByBf5copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1756 B) ▸

   {"actor":"judge","artifact_identity":"cc435d7a1a11a5f982e891e828fde527","band_override":null,"decided_at":"2026-11-02T03:31:44.807Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.5,"investigation_id":"7b231e4d-87b8-4e9b-a6ab-480fa5c4a1dd","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":59,"page_slug":"volo-vault","prev_score":59,"reason":"The core incident facts hold up: the $3.5M loss across three vaults, the compromised admin key, the attacker address, the function name and the auditor list are confirmed (claim_findings[0], [1], [7]). Five of ten claims could not be verified (50%), which puts the page in the significant-issues band. Most of those are untested absence claims or unfetched sources, not contradictions, and the reviewer's confidence is only 0.5, so the penalty sits at the lower end of the band. The page is stale on the net loss figure (claim_findings[3], omission_findings[0]), the ZachXBT claim was not found in the cited source (claim_findings[2]), and the Veridise audit date is uncertain (claim_findings[6]). No disputed findings, shutdown or sanction were reported.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"severity_override":{"applied":true,"band":"significant","from_band":"significant","reason":"omission_findings[0] is material: later recovery updates put the net loss near $60K (about $3.44M clawed back), while the page stops at the April 27 figure of about $200K. The percentage band is already significant, so the band is held there and not moved to deny."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 49cb890b-90d1-4b19-a6a5-594af33ba5cecopy
5. #5rescoreby systemsystem

   2026-11-02 03:31:46Z
   Score: 59 → 63 (+4)
   Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 59 → 63. Problems weighed by who is responsible: incidents the subject suffered −3.2, problems around the subject, caused by others −2.4; legitimacy credit long-running +4; 3 section(s) set aside until a failed fact-check is resolved.
   anchoranchored

   chain

   ●mainnet-betaslot 464,345,139

   sig

   5ByKCJEggqbx…AdFPhjUccopyexplorer ↗

   hash

   8QVb6HbeFXYy…rVAo6WEacopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (717 B) ▸

   {"actor":"system","decided_at":"2026-11-02T03:31:44.807Z","decision":"rescore","investigation_id":"7b231e4d-87b8-4e9b-a6ab-480fa5c4a1dd","new_score":63,"page_slug":"volo-vault","prev_score":59,"reason":"Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 59 → 63. Problems weighed by who is responsible: incidents the subject suffered −3.2, problems around the subject, caused by others −2.4; legitimacy credit long-running +4; 3 section(s) set aside until a failed fact-check is resolved.","score_delta":4,"score_model":"v2","sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 44e4ea1a-3459-49cc-bec2-610b5acbf54ecopy