Audit log

Every state-changing event for Wasabi Protocol: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-28 03:33:23Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,639,161

   sig

   5nDeqdKwtdCa…CsNKJZezcopyexplorer ↗

   hash

   7ps66vsinfQh…X7md8jsEcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (20862 B) ▸

   {"actor":"system:backfill","investigation_id":"994d3e0f-b60a-4242-965c-5a18d3a83a5d","kind":"publish","page_slug":"wasabi-protocol","published_at":"2026-05-28T03:33:23.239Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Wasabi Protocol","sections":[{"content":"On April 30, 2026, Wasabi Protocol was exploited for approximately $5.9 million following the compromise of its deployer wallet, wasabideployer.eth (0x5c629f8c0b5368f523c85bfe79d2a8efb64fb0c8). The deployer EOA held the sole ADMIN_ROLE across every upgradeable vault in the PerpManager framework, with no multisignature requirement and a timelock delay set to zero. The attacker first received 0.188 ETH from a Tornado Cash-linked address at approximately 01:12 UTC. Between 07:07 and 07:36 UTC, additional funding transactions were executed. At 07:46 UTC, malicious contracts were deployed across the affected chains. The attacker, controlling an EOA at 0x02228b0afcdbEdf8180D96Fc181Da3AF5DD1d1ab, used an orchestrator contract at 0x878E94142409DAFCC5CC83D5cD2e9DA2Bf0BF3bF to call grantRole on the protocol's permission contract, instantly activating ADMIN_ROLE for the malicious helper. The orchestrator then executed UUPS proxy upgrades on Wasabi's PerpManager vault contracts and LongPool, replacing legitimate contract logic with malicious implementations at the same addresses. A fake strategy contract was deployed to bypass validation checks, and strategyDeposit() was called to route all vault assets to a drain function. At 07:49:47 UTC, eight Ethereum vaults were drained simultaneously, followed by Base at 07:52:37 UTC, and the Ethereum LongPool at 07:59:35 UTC. By 08:01:11 UTC, 500 ETH had been distributed to a secondary wallet. Chains confirmed affected include Ethereum (approximately $2 million, including 840.9 WETH), Base (approximately $2.5 million), Berachain, and Blast, with losses on the latter two still being reconciled at the time of initial reporting. Assets drained included WETH, USDC, PEPE, REKT, MOG, and several other tokens. Security firms Blockaid, CertiK, PeckShield, Hypernative, and QuillAudits independently detected and analyzed the attack in near real-time.","heading":"April 2026 Admin Key Compromise and Multi-Chain Exploit","severity":"critical","sources":[{"credibility":1,"name":"Wasabi Protocol hit by more than $5 million exploit across multiple chains, security firms say","type":"news_article","url":"https://www.theblock.co/post/399558/wasabi-protocol-hit-by-more-than-5-million-exploit-across-multiple-chains-security-firms-say"},{"credibility":1,"name":"Crypto hacks continue as Wasabi Protocol drained of $4.5 million in admin key compromise","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/30/wasabi-protocol-drained-for-usd4-5-million-in-apparent-admin-key-compromise"},{"credibility":2,"name":"Wasabi Protocol - Rekt News technical breakdown","type":"research","url":"https://rekt.news/wasabi-protocol-rekt"},{"credibility":2,"name":"Explained: The Wasabi Protocol Hack (April 2026) - Halborn","type":"research","url":"https://www.halborn.com/blog/post/explained-the-wasabi-protocol-hack-april-2026"},{"credibility":2,"name":"Wasabi Protocol exploit tied to admin key breach, $5M+ drained across chains - AMBCrypto","type":"news_article","url":"https://ambcrypto.com/wasabi-protocol-exploit-tied-to-admin-key-breach-5m-drained-across-chains/"}]},{"content":"Following the drain, stolen assets were converted to ETH and distributed across five attacker wallets, with a total of approximately $5.9 million tracked by QuillAudits. All five wallets were loaded within a two-hour window prior to the attack. Wallet 1 (0x6244117E1B30101F2De25442211F6A92833Cf906) held approximately 528 ETH and exited through Tornado Cash on May 3, 2026. Wallet 2 (0xb8Bb8aDDd6b283be57b4635Bf913B34824ca70dB) held approximately 300 ETH and exited through Tornado Cash on May 1, 2026. Wallet 3 (0x1A5B4A0bd3f572328AC7a8d7a3A96955F7ed2d95) held approximately 500 ETH and exited through Tornado Cash on May 2, 2026. Wallet 4 held approximately 500 ETH and exited through Tornado Cash on May 4, 2026. Wallet 5 held approximately 737.36 ETH and was still holding as of May 4, 2026. The attacker's funding chain traces back to Tornado Cash-linked addresses beginning approximately six hours before the drain. The use of Tornado Cash for both pre-funding and post-exploit laundering is consistent with obfuscation tradecraft observed in prior state-sponsored DeFi exploits, though no attribution to a specific threat actor has been publicly confirmed.","heading":"On-Chain Fund Flow and Tornado Cash Laundering","severity":"critical","sources":[{"credibility":2,"name":"Wasabi Protocol - Rekt News on-chain analysis","type":"on_chain","url":"https://rekt.news/wasabi-protocol-rekt"},{"credibility":2,"name":"Wasabi Protocol hit by multi-chain attack after admin key compromise - Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/wasabi-protocol-attack-loss/"},{"credibility":2,"name":"Wasabi Protocol Exploited for Over $5M After Admin Key Compromise - MEXC News","type":"news_article","url":"https://www.mexc.com/en-NG/news/1064855"}]},{"content":"Security analysts identified three compounding structural deficiencies that enabled the exploit. First, the protocol's ADMIN_ROLE was held exclusively by a single externally owned account (EOA), wasabideployer.eth, rather than a multisignature wallet requiring multiple approvers. Second, although the protocol's access control framework supported a configurable timelock delay between role grant and activation, this delay was set to zero, meaning ADMIN_ROLE privileges activated instantly upon the grantRole call. Third, the UUPS (Universal Upgradeable Proxy Standard) upgrade mechanism allowed a sole authorized admin to replace the logic of any vault contract with no additional checks or governance oversight. The protocol held audits from Zellic and Sherlock prior to the exploit. These audits examined code-level logic, but as noted by multiple post-mortem analyses, smart contract audits do not typically evaluate private key management practices or operational security posture. No code-level bug was present; the vulnerability was entirely a function of centralized administrative architecture operating without safeguards.","heading":"Smart Contract Architecture Vulnerabilities","severity":"critical","sources":[{"credibility":2,"name":"Explained: The Wasabi Protocol Hack (April 2026) - Halborn","type":"research","url":"https://www.halborn.com/blog/post/explained-the-wasabi-protocol-hack-april-2026"},{"credibility":3,"name":"Anatomy of a Preventable Drain - Medium analysis","type":"research","url":"https://favoriteblockchain.medium.com/anatomy-of-a-preventable-drain-what-the-wasabi-protocol-exploit-teaches-defi-about-admin-key-096abef96408"},{"credibility":2,"name":"Decentralized Perpetual Futures Platform Wasabi Protocol Loses Millions In Deployer Key Compromise - Crowdfund Insider","type":"news_article","url":"https://www.crowdfundinsider.com/2026/05/276724-decentralized-perpetual-futures-platform-wasabi-protocol-loses-millions-in-deployer-key-compromise/"}]},{"content":"Wasabi Protocol issued an initial statement on X at approximately 10:00 UTC on April 30, 2026, acknowledging the issue and advising users not to interact with Wasabi contracts. A second statement at approximately 13:00 UTC confirmed engagement with security response teams including SEAL 911 and Blockaid, noted that Solana deployments were unaffected, and stated that law enforcement including the FBI had been contacted. A first substantive update on May 1, 2026 confirmed the breach was contained. As of publication, the team had not announced a final user compensation plan or confirmed any fund recovery. Bitget News reported that Wasabi Protocol explicitly stated no final compensation plan had been determined. The total value of user funds affected, details of ongoing law enforcement cooperation, and any further post-mortem have not been publicly disclosed.","heading":"Protocol Response and Recovery Status","severity":"high","sources":[{"credibility":2,"name":"Wasabi Protocol Says No Final Compensation Plan in Security Response - Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560605404710"},{"credibility":1,"name":"Wasabi Protocol hit by more than $5 million exploit across multiple chains, security firms say","type":"news_article","url":"https://www.theblock.co/post/399558/wasabi-protocol-hit-by-more-than-5-million-exploit-across-multiple-chains-security-firms-say"},{"credibility":2,"name":"Wasabi Protocol Exploit: Admin Key Attack Drains Funds on Ethereum and Base - BanklessTimes","type":"news_article","url":"https://www.banklesstimes.com/articles/2026/04/30/blockaid-flags-live-admin-key-exploit-hitting-wasabi-protocol-on-ethereum-and-base/"}]},{"content":"Wasabi Protocol was founded in 2022 by co-founders Eren Derman and Kemal Hasan Atay and is headquartered in New York, NY. The protocol offers three core products: Wasabi Perps (on-chain perpetual futures), Wasabi Options, and Liquidity Aggregation, with a focus on enabling leveraged trading of long-tail assets including memecoins and NFTs. Leverage ranges from 2-3x on lower-liquidity assets to up to 10x on major assets such as ETH. The protocol was deployed on Ethereum, Blast, Base, Berachain, and Solana. In June 2024, Wasabi raised a $3 million seed round led by Electric Capital, with participation from Alliance, Luca Netz, Santiago Santos, Zagabond, and DCF God, among others. Prior to the April 2026 exploit, DeFiLlama tracked cumulative DEX volume for the protocol at approximately $277.93 million. Post-exploit TVL as tracked by DeFiLlama showed approximately $1.27 million remaining across chains, with the Solana deployment ($411,013) unaffected.","heading":"Protocol Background and Funding","severity":"low","sources":[{"credibility":1,"name":"Memecoin leverage trading protocol Wasabi raises $3 million led by Electric Capital - The Block","type":"news_article","url":"https://www.theblock.co/post/300465/memecoin-leverage-trading-protocol-wasabi-funding"},{"credibility":2,"name":"Wasabi Protocol TVL and volume - DeFiLlama","type":"on_chain","url":"https://defillama.com/protocol/wasabi"},{"credibility":2,"name":"Wasabi Protocol profile - Messari","type":"research","url":"https://messari.io/project/wasabi-protocol/profile"}]},{"content":"The Wasabi Protocol exploit occurred within a concentrated period of admin key compromise incidents targeting DeFi perpetuals platforms. DeFiLlama recorded approximately 30 separate DeFi incidents in April 2026, with total losses exceeding $625 million. The Wasabi attack shares structural similarities with the alleged Drift Protocol exploit on April 1, 2026, in which attackers reportedly used a compromised admin key to drain $285 million from the Solana-based perpetuals exchange, an incident attributed by some analysts to North Korea-linked threat actors. KelpDAO was also cited as a preceding incident in the same month. The pattern of pre-funding attacker wallets via Tornado Cash prior to draining protocol funds, then exiting proceeds through Tornado Cash, is consistent across multiple 2026 incidents. The Yahoo Finance coverage noted that the clustering of exploits accelerated an emerging theory regarding AI-assisted threat actors targeting DeFi governance architecture, though no attribution has been verified.","heading":"Broader DeFi Context: Admin Key Exploits in April 2026","severity":"medium","sources":[{"credibility":2,"name":"Wasabi Protocol $5 Million Exploit Accelerates AI-Driven DeFi Hacker Theory - Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/wasabi-protocol-5-million-exploit-112509659.html"},{"credibility":2,"name":"Wasabi Loses $5M+ in Latest DeFi Exploit - The Defiant","type":"news_article","url":"https://thedefiant.io/news/hacks/wasabi-protocol-hack"},{"credibility":2,"name":"Wasabi Protocol loses over $5 million in multi-chain exploit - Crypto.news","type":"news_article","url":"https://crypto.news/wasabi-protocol-loses-over-5-million-in-multi-chain-exploit/"}]}],"sources_used":[{"credibility":1,"name":"Wasabi Protocol hit by more than $5 million exploit across multiple chains, security firms say","type":"news_article","url":"https://www.theblock.co/post/399558/wasabi-protocol-hit-by-more-than-5-million-exploit-across-multiple-chains-security-firms-say"},{"credibility":1,"name":"Crypto hacks continue as Wasabi Protocol drained of $4.5 million in admin key compromise","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/30/wasabi-protocol-drained-for-usd4-5-million-in-apparent-admin-key-compromise"},{"credibility":2,"name":"Wasabi Protocol exploit tied to admin key breach, $5M+ drained across chains","type":"news_article","url":"https://ambcrypto.com/wasabi-protocol-exploit-tied-to-admin-key-breach-5m-drained-across-chains/"},{"credibility":2,"name":"Wasabi Protocol - Rekt News","type":"research","url":"https://rekt.news/wasabi-protocol-rekt"},{"credibility":2,"name":"Explained: The Wasabi Protocol Hack (April 2026) - Halborn","type":"research","url":"https://www.halborn.com/blog/post/explained-the-wasabi-protocol-hack-april-2026"},{"credibility":2,"name":"Wasabi Loses $5M+ in Latest DeFi Exploit - The Defiant","type":"news_article","url":"https://thedefiant.io/news/hacks/wasabi-protocol-hack"},{"credibility":2,"name":"Wasabi Protocol hit by multi-chain attack after admin key compromise - CryptoBriefing","type":"news_article","url":"https://cryptobriefing.com/wasabi-protocol-attack-loss/"},{"credibility":2,"name":"Wasabi Protocol Exploit: Admin Key Attack Drains Funds on Ethereum and Base - BanklessTimes","type":"news_article","url":"https://www.banklesstimes.com/articles/2026/04/30/blockaid-flags-live-admin-key-exploit-hitting-wasabi-protocol-on-ethereum-and-base/"},{"credibility":2,"name":"Decentralized Perpetual Futures Platform Wasabi Protocol Loses Millions In Deployer Key Compromise - Crowdfund Insider","type":"news_article","url":"https://www.crowdfundinsider.com/2026/05/276724-decentralized-perpetual-futures-platform-wasabi-protocol-loses-millions-in-deployer-key-compromise/"},{"credibility":2,"name":"Wasabi Protocol hit by $5 million admin key exploit across chains - Cryptonomist","type":"news_article","url":"https://en.cryptonomist.ch/2026/05/01/wasabi-protocol-cross-chain-exploit/"},{"credibility":2,"name":"Wasabi Protocol Loses $5M After Attacker Seizes Deployer Admin Key Across 3 Chains - Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/wasabi-protocol-loses-5m-after-attacker-seizes-deployer-admin-key-across-3-chains/"},{"credibility":2,"name":"Wasabi Protocol loses over $5 million in multi-chain exploit - Crypto.news","type":"news_article","url":"https://crypto.news/wasabi-protocol-loses-over-5-million-in-multi-chain-exploit/"},{"credibility":2,"name":"Wasabi Protocol Says No Final Compensation Plan in Security Response - Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560605404710"},{"credibility":2,"name":"Wasabi Protocol $5 Million Exploit Accelerates AI-Driven DeFi Hacker Theory - Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/wasabi-protocol-5-million-exploit-112509659.html"},{"credibility":2,"name":"Wasabi Protocol Suffers Over $5M Loss in Multi-Chain Exploit - CoinEdition","type":"news_article","url":"https://coinedition.com/wasabi-protocol-suffers-over-5m-loss-in-multi-chain-exploit/"},{"credibility":2,"name":"Wasabi Protocol Suffers a $5.5M Exploit from its Vault Pools - Tekedia","type":"news_article","url":"https://www.tekedia.com/wasabi-protocol-suffers-a-5-5m-exploit-from-its-vault-pools/"},{"credibility":1,"name":"Memecoin leverage trading protocol Wasabi raises $3 million led by Electric Capital - The Block","type":"news_article","url":"https://www.theblock.co/post/300465/memecoin-leverage-trading-protocol-wasabi-funding"},{"credibility":2,"name":"Wasabi Protocol TVL and volume - DeFiLlama","type":"on_chain","url":"https://defillama.com/protocol/wasabi"},{"credibility":2,"name":"Wasabi Protocol profile - Messari","type":"research","url":"https://messari.io/project/wasabi-protocol/profile"},{"credibility":3,"name":"Anatomy of a Preventable Drain: What the Wasabi Protocol Exploit Teaches DeFi About Admin Key Security - Medium","type":"research","url":"https://favoriteblockchain.medium.com/anatomy-of-a-preventable-drain-what-the-wasabi-protocol-exploit-teaches-defi-about-admin-key-096abef96408"}],"summary":"Wasabi Protocol is a decentralized perpetual futures and leverage trading protocol founded in 2022, enabling users to trade memecoins, NFTs, and other long-tail assets with leverage on Ethereum, Base, Blast, and Berachain. On April 30, 2026, the protocol suffered a critical exploit in which an attacker compromised the deployer EOA private key (wasabideployer.eth), granted ADMIN_ROLE to a malicious orchestrator contract with zero timelock delay, and executed UUPS proxy upgrades across all four chains to drain approximately $5.9 million in user funds. The stolen assets were subsequently consolidated into ETH and routed through Tornado Cash across five attacker wallets.","timeline":[{"date":"2022-01-01","event":"Wasabi Protocol founded by Eren Derman and Kemal Hasan Atay in New York, NY.","source":"Tracxn / Alliance company profile","source_url":"https://alliance.xyz/companies/wasabi-protocol"},{"date":"2024-06-18","event":"Wasabi Protocol closes $3 million seed round led by Electric Capital, with participation from Alliance, Luca Netz, Santiago Santos, Zagabond, and DCF God.","source":"The Block","source_url":"https://www.theblock.co/post/300465/memecoin-leverage-trading-protocol-wasabi-funding"},{"date":"2026-04-30","event":"At 01:12 UTC, attacker wallet receives 0.188 ETH from a Tornado Cash-linked address, beginning pre-exploit funding.","source":"Rekt News on-chain analysis","source_url":"https://rekt.news/wasabi-protocol-rekt"},{"date":"2026-04-30","event":"Between 07:07 and 07:36 UTC, additional attacker wallet funding transactions executed. At 07:46 UTC, malicious contracts deployed across chains.","source":"Rekt News on-chain analysis","source_url":"https://rekt.news/wasabi-protocol-rekt"},{"date":"2026-04-30","event":"At 07:49:47 UTC, Ethereum vault drain executes across eight vaults simultaneously. Base drain follows at 07:52:37 UTC. Ethereum LongPool drained at 07:59:35 UTC.","source":"Rekt News on-chain analysis","source_url":"https://rekt.news/wasabi-protocol-rekt"},{"date":"2026-04-30","event":"Blockaid exploit detection system flags the active drain across Ethereum and Base in near real-time. Hypernative, CertiK, and PeckShield subsequently issue independent alerts.","source":"BanklessTimes / The Block","source_url":"https://www.banklesstimes.com/articles/2026/04/30/blockaid-flags-live-admin-key-exploit-hitting-wasabi-protocol-on-ethereum-and-base/"},{"date":"2026-04-30","event":"At approximately 10:00 UTC, Wasabi Protocol issues first public statement on X advising users not to interact with contracts. Second statement at 13:00 UTC confirms SEAL 911 and Blockaid engagement, notes Solana unaffected, and states FBI contacted.","source":"Wasabi Protocol / The Block","source_url":"https://www.theblock.co/post/399558/wasabi-protocol-hit-by-more-than-5-million-exploit-across-multiple-chains-security-firms-say"},{"date":"2026-05-01","event":"Wasabi Protocol issues first substantive update confirming the breach is contained. Berachain and Blast confirmed as additional affected chains.","source":"CryptoBriefing / AMBCrypto","source_url":"https://cryptobriefing.com/wasabi-protocol-attack-loss/"},{"date":"2026-05-01","event":"Attacker Wallet 2 (300 ETH) exits through Tornado Cash.","source":"Rekt News on-chain analysis","source_url":"https://rekt.news/wasabi-protocol-rekt"},{"date":"2026-05-02","event":"Attacker Wallet 3 (500 ETH) exits through Tornado Cash.","source":"Rekt News on-chain analysis","source_url":"https://rekt.news/wasabi-protocol-rekt"},{"date":"2026-05-03","event":"Attacker Wallet 1 (528 ETH) exits through Tornado Cash.","source":"Rekt News on-chain analysis","source_url":"https://rekt.news/wasabi-protocol-rekt"},{"date":"2026-05-04","event":"Attacker Wallet 4 (500 ETH) exits through Tornado Cash. Wallet 5 (737.36 ETH) still holding as of this date.","source":"Rekt News on-chain analysis","source_url":"https://rekt.news/wasabi-protocol-rekt"},{"date":"2026-05-04","event":"Wasabi Protocol states publicly that no final user compensation plan has been determined.","source":"Bitget News","source_url":"https://www.bitget.com/news/detail/12560605404710"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision b690a5de-ab86-46eb-b493-5dcf8613e254copy
2. #2acceptby agent:avoid-moderatoranalyzer

   2026-10-07 08:36:23Z
   Score: 18 → 17 (-1)
   CoinDesk article loads and confirms the April 30, 2026 Wasabi Protocol exploit: about $4.55M lost after the deployer admin key was compromised, with no timelock or multisig. The note's Wasabi Wallet/Bitget claim is a different entity and was not verified or relied on.
   Source:https://www.coindesk.com/tech/2026/04/30/wasabi-protocol-drained-for-usd4-5-million-in-apparent-admin-key-compromise

   Wayback:archived snapshot2026-10-03 22:08:40Z
   anchoranchored

   chain

   ●mainnet-betaslot 454,171,104

   sig

   tFNdmsniM16W…gwyvdof1copyexplorer ↗

   hash

   E2hLPtA7FS2H…xdRyGg3Acopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (741 B) ▸

   {"actor":"agent:avoid-moderator","decided_at":"2026-10-07T08:36:22.948Z","decision":"accept","investigation_id":"994d3e0f-b60a-4242-965c-5a18d3a83a5d","new_score":17,"page_slug":"wasabi-protocol","prev_score":18,"reason":"CoinDesk article loads and confirms the April 30, 2026 Wasabi Protocol exploit: about $4.55M lost after the deployer admin key was compromised, with no timelock or multisig. The note's Wasabi Wallet/Bitget claim is a different entity and was not verified or relied on.","score_delta":-1,"sequence_num":2,"submission_content_hash":"addb2fca46f90105e213d4abbfc333f9909cdb52ad869009cec2c4c5810fdeab","submission_id":"f7cab481-9a03-498d-a360-036ab7283a42","submission_kind":"url","submission_valence":"incriminating","v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision fad71e19-7686-4e3e-8270-0494a8d3cab9copy
3. #3acceptby agent:avoid-moderatoranalyzer

   2026-10-16 02:28:41Z
   Score: 17 → 14 (-3)
   Halborn's post-mortem confirms the ~$5M Wasabi Protocol hack via the compromised wasabideployer.eth sole PerpManager admin account, with no multisig and timelock set to zero, draining funds across Ethereum, Base, Berachain and Blast, matching the submission.
   Source:https://www.halborn.com/blog/post/explained-the-wasabi-protocol-hack-april-2026

   Wayback:archived snapshot2026-09-23 21:22:22Z
   anchoranchored

   chain

   ●mainnet-betaslot 457,470,718

   sig

   4f2osohABEWZ…HD18Q8qfcopyexplorer ↗

   hash

   HixBH62WcgiZ…wFErBVaAcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (731 B) ▸

   {"actor":"agent:avoid-moderator","decided_at":"2026-10-16T02:28:40.884Z","decision":"accept","investigation_id":"994d3e0f-b60a-4242-965c-5a18d3a83a5d","new_score":14,"page_slug":"wasabi-protocol","prev_score":17,"reason":"Halborn's post-mortem confirms the ~$5M Wasabi Protocol hack via the compromised wasabideployer.eth sole PerpManager admin account, with no multisig and timelock set to zero, draining funds across Ethereum, Base, Berachain and Blast, matching the submission.","score_delta":-3,"sequence_num":3,"submission_content_hash":"d904dd170e63c95f125d7aa326df245ee4e3bf418815541acc2bc70e514acaab","submission_id":"0d21a635-62a6-4b82-b6b2-006b00e73561","submission_kind":"url","submission_valence":"incriminating","v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 61b253c0-529b-4f10-a2f5-ba58a5c82420copy
4. #4acceptby agent:avoid-moderatoranalyzer

   2026-10-17 03:28:27Z
   Score: 14 → 8 (-6)
   The Block confirms Wasabi Protocol was exploited for over $5M via a compromised admin key/deployer wallet, and quotes Sodot's Shalev Keren describing the zero-delay admin role as an operational design choice rather than a code bug — matching the submission's note.
   Source:https://www.theblock.co/post/399558/wasabi-protocol-hit-by-more-than-5-million-exploit-across-multiple-chains-security-firms-say

   Wayback:failed
   anchoranchored

   chain

   ●mainnet-betaslot 457,887,270

   sig

   3QsMZWphAh4o…zRFtrzT8copyexplorer ↗

   hash

   766frps6xUBb…raFwr4Uacopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (736 B) ▸

   {"actor":"agent:avoid-moderator","decided_at":"2026-10-17T03:28:27.158Z","decision":"accept","investigation_id":"994d3e0f-b60a-4242-965c-5a18d3a83a5d","new_score":8,"page_slug":"wasabi-protocol","prev_score":14,"reason":"The Block confirms Wasabi Protocol was exploited for over $5M via a compromised admin key/deployer wallet, and quotes Sodot's Shalev Keren describing the zero-delay admin role as an operational design choice rather than a code bug — matching the submission's note.","score_delta":-6,"sequence_num":4,"submission_content_hash":"15541f21553a793648fd070c98723c7bfdef44d3f536d10e2ba3c4b28c6310e7","submission_id":"938f56b4-16dd-4c24-a0cb-d071b1778413","submission_kind":"url","submission_valence":"incriminating","v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ac8f4c3d-e81f-456d-a12f-9e2966243b18copy
5. #5reviewby reviewerreviewer

   2026-10-26 22:57:00Z
   Score: 8 → 8 (no score change)
   The core incident facts hold up against CoinDesk, The Block and Rekt: date, chains, loss range, admin-key mechanics, Tornado Cash funding and context figures. The page hedges and attributes single-source claims well. The weak points are an unsourced CertiK $5.5M figure, a SlowMist affiliation not stated in the cited source, and a May 2026 status that rests on a blocked low-tier aggregator. The page is stale for October 2026 and should be updated with later developments.
   anchoranchored

   chain

   ●mainnet-betaslot 461,841,574

   sig

   4Lr5kiDsV3Rn…k5UAp79Scopyexplorer ↗

   hash

   4Aquig5N67Nv…uaAth6VBcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1359 B) ▸

   {"actor":"reviewer","artifact_identity":"4ff8d61c69898b591e7ade7b5b063c4f","blocked_count":1,"decided_at":"2026-10-26T22:56:59.980Z","decision":"review","disputed_pct":0,"findings_hash":"9wf9dmSR2VjyHsUasv9ukGMvG2DNK2475YUjQmGref66","investigation_id":"994d3e0f-b60a-4242-965c-5a18d3a83a5d","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":8,"omissions":{"material":0,"total":1},"page_content_hash":"9ccf044a3bcfa0ce7d260422391cca768c6ca543df2125d9378d9a0fe2453893","page_slug":"wasabi-protocol","prev_score":8,"reason":"The core incident facts hold up against CoinDesk, The Block and Rekt: date, chains, loss range, admin-key mechanics, Tornado Cash funding and context figures. The page hedges and attributes single-source claims well. The weak points are an unsourced CertiK $5.5M figure, a SlowMist affiliation not stated in the cited source, and a May 2026 status that rests on a blocked low-tier aggregator. The page is stale for October 2026 and should be updated with later developments.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":12,"sequence_num":5,"subject_status":"exploited","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 5a537f70-6d82-4e99-9515-4376af63a1cdcopy
6. #6review reviseby judgejudge

   2026-10-26 22:57:00Z
   Score: 8 → 3 (-5)
   The core incident facts hold up: of 13 claims checked, 12 count toward the percentage (one was excluded because its source blocked the reviewer) and none were disputed or unverifiable, so the claim-level disputed rate is 0%. The verdict moves off approval only because of the high-priority coverage gap on current status: the page's latest information is from May 2026, and it is now October 2026, so later compensation, relaunch or legal developments are unchecked. Smaller issues are the CertiK $5.5M figure with no supporting citation (claim_findings[3]), a SlowMist affiliation not stated in the cited source (claim_findings[8]), and the May 3 and May 9 status claims resting on a blocked tier-3 aggregator (claim_findings[5]). The one omission (LP-token warning) is minor and no shutdown or sanction contradicts the page.
   anchoranchored

   chain

   ●mainnet-betaslot 461,841,578

   sig

   4LZ7g4UFEBdj…9cs7wsF3copyexplorer ↗

   hash

   EWEdjkKzSp4m…MRyH8XhDcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (2477 B) ▸

   {"actor":"judge","artifact_identity":"4ff8d61c69898b591e7ade7b5b063c4f","band_override":{"actual_delta":-5,"actual_verdict":"review_revise","disputed_pct":0,"expected_delta_range":[0,0],"expected_verdict":"review_approve","rationale":"The core incident facts hold up: of 13 claims checked, 12 count toward the percentage (one was excluded because its source blocked the reviewer) and none were disputed or unverifiable, so the claim-level disputed rate is 0%. The verdict moves off approval only because of the high-priority coverage gap on current status: the page's latest information is from May 2026, and it is now October 2026, so later compensation, relaunch or legal developments are unchecked. Smaller issues are the CertiK $5.5M figure with no supporting citation (claim_findings[3]), a SlowMist affiliation not stated in the cited source (claim_findings[8]), and the May 3 and May 9 status claims resting on a blocked tier-3 aggregator (claim_findings[5]). The one omission (LP-token warning) is minor and no shutdown or sanction contradicts the page."},"blocked_count":1,"decided_at":"2026-10-26T22:56:59.980Z","decision":"review_revise","delist_requested":false,"disputed_pct":0,"investigation_id":"994d3e0f-b60a-4242-965c-5a18d3a83a5d","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":3,"page_slug":"wasabi-protocol","prev_score":8,"reason":"The core incident facts hold up: of 13 claims checked, 12 count toward the percentage (one was excluded because its source blocked the reviewer) and none were disputed or unverifiable, so the claim-level disputed rate is 0%. The verdict moves off approval only because of the high-priority coverage gap on current status: the page's latest information is from May 2026, and it is now October 2026, so later compensation, relaunch or legal developments are unchecked. Smaller issues are the CertiK $5.5M figure with no supporting citation (claim_findings[3]), a SlowMist affiliation not stated in the cited source (claim_findings[8]), and the May 3 and May 9 status claims resting on a blocked tier-3 aggregator (claim_findings[5]). The one omission (LP-token warning) is minor and no shutdown or sanction contradicts the page.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":-5,"scored_claims":12,"sequence_num":6,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision fdbfc329-15e9-45a7-96e8-1518c65e7f6bcopy
7. #7reviewby reviewerreviewer

   2026-10-29 13:55:49Z
   Score: 3 → 3 (no score change)
   The core exploit narrative (April 30, 2026, compromised sole admin key, UUPS upgrades, loss range of $4.5M to $5.9M) is well supported by Coindesk, Rekt, TechFlow and Forklog, and the page transparently presents the divergent figures and root-cause accounts. Minor issues are the 20x leverage claim (cited source says 2-3x to 10x), the CertiK 'initial $2.9M' estimate that is absent from Forklog, a ZeroShadow attribution not found in TechFlow, and the inference of continued operations from TVL. Two sources were blocked (DefiLlama, CryptoTimes). No later developments were found, and the page hedges appropriately.
   anchoranchored

   chain

   ●mainnet-betaslot 462,905,625

   sig

   3XTuAvuCtMiL…kZyWgJYocopyexplorer ↗

   hash

   BPNTqXzbyLag…UVkVBw4xcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1469 B) ▸

   {"actor":"reviewer","artifact_identity":"e2cd4956d7bdad4c01b74bbb67cf2578","blocked_count":2,"decided_at":"2026-10-29T13:55:49.624Z","decision":"review","disputed_pct":0.1667,"findings_hash":"9VtdMXvSgFZ5fog9PrRGACUwnwA9GkvFSrZy3MAgXQQN","investigation_id":"994d3e0f-b60a-4242-965c-5a18d3a83a5d","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":3,"page_content_hash":"eeec8d0d6ca9d2b02e919a9d74513cb7bce92a1d0a10c0e8afc32e492e29bcd6","page_slug":"wasabi-protocol","prev_score":3,"reason":"The core exploit narrative (April 30, 2026, compromised sole admin key, UUPS upgrades, loss range of $4.5M to $5.9M) is well supported by Coindesk, Rekt, TechFlow and Forklog, and the page transparently presents the divergent figures and root-cause accounts. Minor issues are the 20x leverage claim (cited source says 2-3x to 10x), the CertiK 'initial $2.9M' estimate that is absent from Forklog, a ZeroShadow attribution not found in TechFlow, and the inference of continued operations from TVL. Two sources were blocked (DefiLlama, CryptoTimes). No later developments were found, and the page hedges appropriately.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":12,"sequence_num":7,"subject_status":"exploited","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 945db348-0006-4098-93bd-667aaab6ceb4copy
8. #8review reviseby judgejudge

   2026-10-29 13:55:49Z
   Score: 3 → 0 (-8)
   The core account of the April 30, 2026 exploit (compromised sole admin key, UUPS upgrades, a loss range of $4.5M to $5.9M) is confirmed by Coindesk, Rekt, TechFlow and Forklog (claim_findings[2], [4], [5], [6]). Of 12 scorable claims, none were disputed and 2 could not be verified (about 17%): the 20x leverage figure, which the cited Block article does not support (claim_findings[1]), and the ZeroShadow attribution, which was not found in TechFlow (claim_findings[7]). Smaller issues are the unsourced CertiK 'initial $2.9M' estimate (claim_findings[3]) and the inference of continued operations from residual TVL (claim_findings[11]). The reviewer also flagged a high-priority gap, because the page does not cite Wasabi's own incident updates or the Halborn explainer. Two blocked sources (DefiLlama, CryptoTimes) were left out of the percentage and limit what could be checked, but they are not counted against the page. The review found no material omission, and the page already says the protocol was exploited.
   anchoranchored

   chain

   ●mainnet-betaslot 462,905,631

   sig

   2r86EhAhXkuh…iRV1ZKedcopyexplorer ↗

   hash

   5UdvYY9mxNj1…bSyCDqwFcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1704 B) ▸

   {"actor":"judge","artifact_identity":"e2cd4956d7bdad4c01b74bbb67cf2578","band_override":null,"blocked_count":2,"decided_at":"2026-10-29T13:55:49.624Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.1667,"investigation_id":"994d3e0f-b60a-4242-965c-5a18d3a83a5d","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":0,"page_slug":"wasabi-protocol","prev_score":3,"reason":"The core account of the April 30, 2026 exploit (compromised sole admin key, UUPS upgrades, a loss range of $4.5M to $5.9M) is confirmed by Coindesk, Rekt, TechFlow and Forklog (claim_findings[2], [4], [5], [6]). Of 12 scorable claims, none were disputed and 2 could not be verified (about 17%): the 20x leverage figure, which the cited Block article does not support (claim_findings[1]), and the ZeroShadow attribution, which was not found in TechFlow (claim_findings[7]). Smaller issues are the unsourced CertiK 'initial $2.9M' estimate (claim_findings[3]) and the inference of continued operations from residual TVL (claim_findings[11]). The reviewer also flagged a high-priority gap, because the page does not cite Wasabi's own incident updates or the Halborn explainer. Two blocked sources (DefiLlama, CryptoTimes) were left out of the percentage and limit what could be checked, but they are not counted against the page. The review found no material omission, and the page already says the protocol was exploited.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":-8,"scored_claims":12,"sequence_num":8,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision e8375026-cc97-4209-a0c7-0707c6294e6bcopy
9. #9rescoreby systemsystem

   2026-11-01 12:37:25Z
   Score: 0 → 52 (+52)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 0 → 52. Problems weighed by who is responsible: incidents the subject suffered −13.2, concerns that are not fraud −7.2, problems around the subject, caused by others −0.8; legitimacy credit long-running +4; accepted community evidence −5.9; fact-check adjustments (−13) now shown as page reliability, not in the score.
   anchoranchored

   chain

   ●mainnet-betaslot 464,095,223

   sig

   4kZJeGgUVQA9…tJZbozTNcopyexplorer ↗

   hash

   G5qwhGmW53KD…xZLdpZEHcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (757 B) ▸

   {"actor":"system","decided_at":"2026-11-01T12:37:25.164Z","decision":"rescore","investigation_id":"994d3e0f-b60a-4242-965c-5a18d3a83a5d","new_score":52,"page_slug":"wasabi-protocol","prev_score":0,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 0 → 52. Problems weighed by who is responsible: incidents the subject suffered −13.2, concerns that are not fraud −7.2, problems around the subject, caused by others −0.8; legitimacy credit long-running +4; accepted community evidence −5.9; fact-check adjustments (−13) now shown as page reliability, not in the score.","score_delta":52,"score_model":"v2","sequence_num":9,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 8a8eed10-52e7-4e96-ab37-cef571bd17c9copy
10. #10reviewby reviewerreviewer

    2026-11-01 17:53:17Z
    Score: 52 → 52 (no score change)
    The core exploit narrative holds. The amounts, vaults, the single-key admin with zero timelock delay, Tornado Cash laundering and the Rekt details all match primary coverage. The page handles conflicting loss estimates and the AWS claim with appropriate hedging. Not checked: the DefiLlama TVL figures and the June 2024 The Block figures. No shutdown or sanction was found.
    anchoranchored

    chain

    ●mainnet-betaslot 464,183,108

    sig

    39cfeZx7durL…wPUyyXAZcopyexplorer ↗

    hash

    ESrNJgYtTzHV…y16oPk5dcopysha256 → base58

    verifying row…full verify ↗

    canonical bytes (1265 B) ▸

    {"actor":"reviewer","artifact_identity":"56294d3652250b1225da07fe976c6b4d","blocked_count":1,"decided_at":"2026-11-01T17:53:17.515Z","decision":"review","disputed_pct":0.1429,"findings_hash":"AjZpmejT1rCegA5EZXBdpcULmVhUA36tSoPQfPa2775k","investigation_id":"994d3e0f-b60a-4242-965c-5a18d3a83a5d","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":52,"omissions":{"material":0,"total":1},"page_content_hash":"05aa503f6b762b9924b7d84e5eed947af76704622828fd709f8d8d5d7c89df54","page_slug":"wasabi-protocol","prev_score":52,"reason":"The core exploit narrative holds. The amounts, vaults, the single-key admin with zero timelock delay, Tornado Cash laundering and the Rekt details all match primary coverage. The page handles conflicting loss estimates and the AWS claim with appropriate hedging. Not checked: the DefiLlama TVL figures and the June 2024 The Block figures. No shutdown or sanction was found.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":7,"sequence_num":10,"subject_status":"exploited","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

    Verify offline (run on your own machine)

    python -m src.verify_decision 8e67d82f-0143-49da-9da3-4647401c39a3copy
11. #11review reviseby judgejudge

    2026-11-01 17:53:17Z
    Score: 52 → 52 (no score change)
    Of 8 claim findings, 1 was excluded because the source blocked the reviewer (claim_findings[6], DefiLlama TVL). Of the remaining 7, none were disputed and 1 could not be verified (claim_findings[7], the June 2024 The Block figures, not checked), so about 14% are unresolved, which falls in the minor-issues band. The core exploit account is confirmed by CoinDesk, Halborn and Rekt (claim_findings[0-4]). The only other weakness is claim_findings[5], where the May 2-3 withdrawal resumption is supported only by aggregator summaries and the cited Phemex article is the one carrying the uncorroborated AWS claim. The penalty is kept at the low end because the unverified items reflect limited reviewer effort rather than evidence against the page.
    anchoranchored

    chain

    ●mainnet-betaslot 464,183,113

    sig

    5p3SxWFoHh1Y…NqTCuHvrcopyexplorer ↗

    hash

    6jp2Gufq1Q2F…5B6M2Y4Tcopysha256 → base58

    verifying row…full verify ↗

    canonical bytes (1431 B) ▸

    {"actor":"judge","artifact_identity":"56294d3652250b1225da07fe976c6b4d","band_override":null,"blocked_count":1,"decided_at":"2026-11-01T17:53:17.515Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.1429,"investigation_id":"994d3e0f-b60a-4242-965c-5a18d3a83a5d","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":52,"page_slug":"wasabi-protocol","prev_score":52,"reason":"Of 8 claim findings, 1 was excluded because the source blocked the reviewer (claim_findings[6], DefiLlama TVL). Of the remaining 7, none were disputed and 1 could not be verified (claim_findings[7], the June 2024 The Block figures, not checked), so about 14% are unresolved, which falls in the minor-issues band. The core exploit account is confirmed by CoinDesk, Halborn and Rekt (claim_findings[0-4]). The only other weakness is claim_findings[5], where the May 2-3 withdrawal resumption is supported only by aggregator summaries and the cited Phemex article is the one carrying the uncorroborated AWS claim. The penalty is kept at the low end because the unverified items reflect limited reviewer effort rather than evidence against the page.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":7,"sequence_num":11,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

    Verify offline (run on your own machine)

    python -m src.verify_decision 697df73d-d961-43fa-9e08-5f1c4f9c606dcopy
12. #12rescoreby systemsystem

    2026-11-01 17:53:18Z
    Score: 52 → 53 (+1)
    Recalculated after the fact-check of 2026-11-01. Rescored under Scoring v2, the published formula (avoid.net/scoring): 52 → 53. Problems weighed by who is responsible: incidents the subject suffered −13.2, concerns that are not fraud −7.2; legitimacy credit long-running +4; 1 section(s) set aside until a failed fact-check is resolved; accepted community evidence −5.9.
    anchoranchored

    chain

    ●mainnet-betaslot 464,183,119

    sig

    4JqQqjBcQFiq…cisvZeRNcopyexplorer ↗

    hash

    J3vNRyWWC6rF…EzgeiJQ9copysha256 → base58

    verifying row…full verify ↗

    canonical bytes (740 B) ▸

    {"actor":"system","decided_at":"2026-11-01T17:53:17.515Z","decision":"rescore","investigation_id":"994d3e0f-b60a-4242-965c-5a18d3a83a5d","new_score":53,"page_slug":"wasabi-protocol","prev_score":52,"reason":"Recalculated after the fact-check of 2026-11-01. Rescored under Scoring v2, the published formula (avoid.net/scoring): 52 → 53. Problems weighed by who is responsible: incidents the subject suffered −13.2, concerns that are not fraud −7.2; legitimacy credit long-running +4; 1 section(s) set aside until a failed fact-check is resolved; accepted community evidence −5.9.","score_delta":1,"score_model":"v2","sequence_num":12,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

    Verify offline (run on your own machine)

    python -m src.verify_decision 6863d5df-29ba-49fb-b82c-e0e2f973f94bcopy
13. #13rescoreby systemsystem

    2026-11-01 21:49:54Z
    Score: 53 → 52 (-1)
    Re-read and rescored after the page was re-researched (2026-11-01). Rescored under Scoring v2, the published formula (avoid.net/scoring): 53 → 52. Problems weighed by who is responsible: incidents the subject suffered −13.2, concerns that are not fraud −6, problems around the subject, caused by others −1.9; legitimacy credit long-running +4; accepted community evidence −5.9.
    anchoranchored

    chain

    ●mainnet-betaslot 464,249,414

    sig

    YKqcAC7pQCNn…XD5z1V5Tcopyexplorer ↗

    hash

    7jVZL9JuiTQR…DZ7mK9jZcopysha256 → base58

    verifying row…full verify ↗

    canonical bytes (748 B) ▸

    {"actor":"system","decided_at":"2026-11-01T21:49:53.782Z","decision":"rescore","investigation_id":"994d3e0f-b60a-4242-965c-5a18d3a83a5d","new_score":52,"page_slug":"wasabi-protocol","prev_score":53,"reason":"Re-read and rescored after the page was re-researched (2026-11-01). Rescored under Scoring v2, the published formula (avoid.net/scoring): 53 → 52. Problems weighed by who is responsible: incidents the subject suffered −13.2, concerns that are not fraud −6, problems around the subject, caused by others −1.9; legitimacy credit long-running +4; accepted community evidence −5.9.","score_delta":-1,"score_model":"v2","sequence_num":13,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

    Verify offline (run on your own machine)

    python -m src.verify_decision de134d26-d938-40b1-b7b8-09cf0546b129copy
14. #14reviewby reviewerreviewer

    2026-11-01 21:51:34Z
    Score: 52 → 52 (no score change)
    The page is carefully hedged and its main claims on the exploit, root cause, fund movement and 2024 funding match rekt.news, CoinDesk, The Block, Halborn and Phemex. Minor issues are the unverified wBITCOIN vault name and a Blockaid revoke-approvals detail that is not in the cited article. The TVL figures were not checked directly. No shutdown, sanction or rebrand was found.
    anchoranchored

    chain

    ●mainnet-betaslot 464,249,840

    sig

    5PEH68TFh1Ai…4YSrg9J3copyexplorer ↗

    hash

    xiSNPmWwdJpp…8d26jUnscopysha256 → base58

    verifying row…full verify ↗

    canonical bytes (1265 B) ▸

    {"actor":"reviewer","artifact_identity":"9a97725cb2e06ec077c3d3d292a4f0e9","blocked_count":1,"decided_at":"2026-11-01T21:51:34.171Z","decision":"review","disputed_pct":0,"findings_hash":"E52afQKvMkob1go5v3QQFWg7BME12L8krvy376fVFoFS","investigation_id":"994d3e0f-b60a-4242-965c-5a18d3a83a5d","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":52,"omissions":{"material":0,"total":1},"page_content_hash":"4e57ba89b4abbebd8a11b6838bcaa4e3dea0a12fcd5066c20f3726e746eddcb1","page_slug":"wasabi-protocol","prev_score":52,"reason":"The page is carefully hedged and its main claims on the exploit, root cause, fund movement and 2024 funding match rekt.news, CoinDesk, The Block, Halborn and Phemex. Minor issues are the unverified wBITCOIN vault name and a Blockaid revoke-approvals detail that is not in the cited article. The TVL figures were not checked directly. No shutdown, sanction or rebrand was found.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":13,"sequence_num":14,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

    Verify offline (run on your own machine)

    python -m src.verify_decision bd1a8973-e088-456d-8b30-9ae1af70c118copy
15. #15review approveby judgejudge

    2026-11-01 21:51:34Z
    Score: 52 → 52 (no score change)
    Of 14 claim findings, 13 were counted after leaving out claim_findings[13] (DefiLlama TVL), which the reviewer could not fetch because the source was blocked; none of the 13 were disputed or unverifiable, so the disputed share is 0%. Two findings were only partly supported (claim_findings[2], a vault name not found in the fetched source, and claim_findings[3], a Blockaid revoke-approvals detail missing from the cited article), but both are minor details and not the core allegations. The core account of the exploit, the root cause, fund movement and the 2024 funding round matched Tier 1 and Tier 2 sources. No shutdown, sanction or rebrand was found, and the only omission (compensation status) is minor. The blocked TVL check is a coverage limit, not a defect of the page.
    anchoranchored

    chain

    ●mainnet-betaslot 464,249,845

    sig

    2EheuGA2NYpZ…iUo6SyJVcopyexplorer ↗

    hash

    Hrq2QnnZzKCM…UE56jjgzcopysha256 → base58

    verifying row…full verify ↗

    canonical bytes (1462 B) ▸

    {"actor":"judge","artifact_identity":"9a97725cb2e06ec077c3d3d292a4f0e9","band_override":null,"blocked_count":1,"decided_at":"2026-11-01T21:51:34.171Z","decision":"review_approve","delist_requested":false,"disputed_pct":0,"investigation_id":"994d3e0f-b60a-4242-965c-5a18d3a83a5d","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":52,"page_slug":"wasabi-protocol","prev_score":52,"reason":"Of 14 claim findings, 13 were counted after leaving out claim_findings[13] (DefiLlama TVL), which the reviewer could not fetch because the source was blocked; none of the 13 were disputed or unverifiable, so the disputed share is 0%. Two findings were only partly supported (claim_findings[2], a vault name not found in the fetched source, and claim_findings[3], a Blockaid revoke-approvals detail missing from the cited article), but both are minor details and not the core allegations. The core account of the exploit, the root cause, fund movement and the 2024 funding round matched Tier 1 and Tier 2 sources. No shutdown, sanction or rebrand was found, and the only omission (compensation status) is minor. The blocked TVL check is a coverage limit, not a defect of the page.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":13,"sequence_num":15,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

    Verify offline (run on your own machine)

    python -m src.verify_decision be04f995-353c-423d-9d2b-180e39db4aa5copy
16. #16rescoreby systemsystem

    2026-11-01 21:51:35Z
    Score: 52 → 53 (+1)
    Recalculated after the fact-check of 2026-11-01. Rescored under Scoring v2, the published formula (avoid.net/scoring): 52 → 53. Problems weighed by who is responsible: incidents the subject suffered −13.2, concerns that are not fraud −6, problems around the subject, caused by others −1.1; legitimacy credit long-running +4; 1 section(s) set aside until a failed fact-check is resolved; accepted community evidence −5.9.
    anchoranchored

    chain

    ●mainnet-betaslot 464,249,850

    sig

    3ZG1gy2NsgDs…cp8nSfBTcopyexplorer ↗

    hash

    3k6u85V9EBZo…HPFcBVQccopysha256 → base58

    verifying row…full verify ↗

    canonical bytes (790 B) ▸

    {"actor":"system","decided_at":"2026-11-01T21:51:34.171Z","decision":"rescore","investigation_id":"994d3e0f-b60a-4242-965c-5a18d3a83a5d","new_score":53,"page_slug":"wasabi-protocol","prev_score":52,"reason":"Recalculated after the fact-check of 2026-11-01. Rescored under Scoring v2, the published formula (avoid.net/scoring): 52 → 53. Problems weighed by who is responsible: incidents the subject suffered −13.2, concerns that are not fraud −6, problems around the subject, caused by others −1.1; legitimacy credit long-running +4; 1 section(s) set aside until a failed fact-check is resolved; accepted community evidence −5.9.","score_delta":1,"score_model":"v2","sequence_num":16,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

    Verify offline (run on your own machine)

    python -m src.verify_decision 4e0a4771-3d0e-4071-9bd3-92469045770acopy