Audit log

Every state-changing event for Wrapped BTC (Portal): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-10-08 04:31:16Z
   Score: ? → ? (no score change)
   anchorfailed

   chain

   ●—

   hash

   8mWt7HWShBFa…Y3vNr3Lncopysha256 → base58

   verifying row…

   canonical bytes (14874 B) ▸

   {"actor":"system:backfill","investigation_id":"2a9c4df5-b7a0-4f63-98e9-7a13adc1e4d2","kind":"publish","page_slug":"wrapped-btc-portal","published_at":"2026-10-08T04:31:16.829Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Wrapped BTC (Portal)","sections":[{"content":"The token trades under the symbol WBTC on Solana and is displayed by wallet and price-tracking services under two overlapping names, \"Wrapped BTC (Portal)\" and \"Wrapped BTC (Wormhole)\" — Portal is the rebranded front-end application for the Wormhole cross-chain messaging protocol. According to a Solflare price page that lists the exact mint address 3NZ9JMVBmGAqocybic2c7LQCJScmgsAZ6vQqTDzcqmJh, the token carries a \"Verified\" status in the Solana token registry display, though the page itself cautions that this label is not proof of safety. A Coinranking profile for the same mint describes the token as \"created and managed by the Wormhole bridge protocol,\" with transfers approved by a Guardian Network described as 19 independent validators requiring a 13-of-19 signature threshold before assets are minted or released. The stated mechanism is lock-and-mint: Bitcoin-denominated value is locked in a contract on the source side and an equivalent amount of this token is minted on Solana; redemption burns the Solana token and releases the underlying asset. This is a trusted-validator-set design rather than a trustless one, and it adds at least one additional layer of custodial and contract risk beyond holding BTC directly or even beyond holding the original Ethereum-based WBTC (which is itself custodied by BitGo).","heading":"What the token is and how it is backed","severity":"medium","sources":[{"credibility":2,"name":"Solflare — Wrapped BTC (Portal) price page","type":"other","url":"https://solflare.com/prices/wrapped-btc-portal/3NZ9JMVBmGAqocybic2c7LQCJScmgsAZ6vQqTDzcqmJh"},{"credibility":2,"name":"Coinranking — What is Wrapped BTC (Wormhole) (WBTC)?","type":"other","url":"https://coinranking.com/coin/FwSkN6za3+wrappedbtcwormhole-wbtc/about"}]},{"content":"Different Solana-facing platforms display this exact mint address under different names and with materially different market statistics at the same point in time, which is a source of potential confusion for holders trying to verify what they are exposed to. One Solflare page labels the mint \"Wrapped BTC (Portal)\" with one market-cap figure, another Solflare URL labels the identical address \"Wrapped BTC (Wormhole)\" with a different price and market cap, and a third tracker (MadeOnSol) lists yet another market cap for the same address. \"Portal\" and \"Wormhole\" refer to the same underlying bridge infrastructure (Portal is Wormhole's token-bridge application), so the naming variants appear to refer to the same asset rather than to competing tokens, but users should always confirm the mint address directly rather than relying on a displayed name alone, since tokens with duplicate names/symbols are a known vector for impersonation on Solana.","heading":"Naming inconsistency across platforms","severity":"low","sources":[{"credibility":2,"name":"Solflare — Wrapped BTC (Portal) price page","type":"other","url":"https://solflare.com/prices/wrapped-btc-portal/3NZ9JMVBmGAqocybic2c7LQCJScmgsAZ6vQqTDzcqmJh"},{"credibility":2,"name":"Solflare — Wrapped BTC (Wormhole) price page","type":"other","url":"https://www.solflare.com/prices/wrapped-btc-wormhole/3NZ9JMVBmGAqocybic2c7LQCJScmgsAZ6vQqTDzcqmJh/"},{"credibility":3,"name":"MadeOnSol — token page","type":"other","url":"https://madeonsol.com/token/3NZ9JMVBmGAqocybic2c7LQCJScmgsAZ6vQqTDzcqmJh"}]},{"content":"This token rides on the Wormhole bridge, the same infrastructure that suffered one of the largest DeFi hacks on record. On February 2, 2022, an attacker exploited a signature-verification flaw in Wormhole's Solana-Ethereum bridge contract to mint 120,000 wrapped ETH without posting legitimate collateral, a loss reported at the time as approximately $325 million. Coverage from the following day quotes Wormhole stating that \"ETH will be added over the next hours to ensure wETH is backed 1:1,\" and other reporting states that Jump Crypto, the trading firm behind Wormhole, replenished the stolen funds within days so the bridge could keep operating. The hack targeted wrapped ETH rather than wrapped BTC specifically, and this Solana WBTC token was not reported as directly compromised in that incident, but the episode demonstrates that the bridge architecture underlying this token has a history of catastrophic smart-contract failure that required an off-chain bailout by a private trading firm to make users whole.","heading":"2022 Wormhole bridge hack (underlying infrastructure)","severity":"high","sources":[{"credibility":1,"name":"Security Affairs — Wormhole cryptocurrency platform hacked, crooks stole $326 million","type":"news_article","url":"https://securityaffairs.com/127570/cyber-crime/wormhole-hack.html"},{"credibility":2,"name":"web3isgoinggreat.com — Wormhole bridge hack entry","type":"research","url":"https://www.web3isgoinggreat.com/single/wormhole-bridge-hack"}]},{"content":"In February 2023, the DeFi front-end Oasis reported that, acting under a High Court of England and Wales order dated February 21, 2023, it exploited a previously unknown vulnerability in its own admin multisig to seize roughly $140 million in assets traceable to the 2022 Wormhole exploit, which had been deposited into a Maker Protocol vault, and returned them to an authorized third party. Jump Crypto and Oasis did not immediately comment publicly on the operation. The episode drew criticism from parts of the DeFi community over the precedent of a platform altering smart-contract access to seize funds from a user's wallet, which commentators described as revealing an undisclosed administrative \"backdoor\" in the protocol; MakerDAO stated that the front-end involved was not developed or maintained by MakerDAO itself. This is background on the broader Wormhole ecosystem's risk and governance history rather than a claim specific to this token.","heading":"2023 counter-exploit recovery tied to the Wormhole hack","severity":"medium","sources":[{"credibility":2,"name":"Blockworks — Jump Crypto Just Counter-Exploited the Wormhole Hacker for $140 Million","type":"news_article","url":"https://blockworks.com/news/jump-crypto-wormhole-hack-recovery"},{"credibility":2,"name":"web3isgoinggreat.com — Oasis rewrites the rules for Jump Crypto to recover stolen assets","type":"research","url":"https://web3isgoinggreat.com/single/oasis-rewrites-the-rules-for-jump-crypto"}]},{"content":"Holders should not confuse this Wormhole/Portal-bridged token with a separate, now largely defunct wrapped-Bitcoin product on Solana known as soBTC, which was bridged via the Sollet bridge and reported to be issued or backed by FTX/Alameda-linked entities. Reporting from November 2022 states that after FTX and Alameda Research filed for bankruptcy, Sollet-wrapped tokens including soBTC were widely reported as no longer redeemable and traded at a steep discount to Bitcoin's spot price (one report cited a 77% discount), raising DeFi-contagion concerns because soBTC had been widely used as collateral on Solana lending markets. The Wormhole/Portal bridge is operated by different parties (Jump Crypto / the Wormhole Guardian network) than the Sollet bridge, and no source found in this investigation alleges that the token at this mint address (3NZ9JMVBmGAqocybic2c7LQCJScmgsAZ6vQqTDzcqmJh) suffered a comparable depegging or redemption failure. The soBTC episode is included here only as documented sector history illustrating that bridged-BTC products on Solana have previously failed when their issuing/custodial counterparty collapsed, and as a general caution that the trustworthiness of any wrapped-BTC token depends on the solvency and conduct of its specific bridge operator, not only on code.","heading":"Distinct from the 2022 Sollet/FTX-wrapped Bitcoin collapse","severity":"medium","sources":[{"credibility":2,"name":"The Block — Wrapped tokens issued by FTX or Alameda collapsing, no longer redeemable","type":"news_article","url":"https://www.theblock.co/post/186326/wrapped-tokens-issued-by-ftx-or-alameda-collapsing-no-longer-redeemable"},{"credibility":2,"name":"The Defiant — FTX-Backed Bitcoin and Ether Tokens Depeg On Solana","type":"news_article","url":"https://thedefiant.io/news/cefi/solana-btc-eth-depeg"}]},{"content":"Wormhole published a notice stating that the legacy Portal Bridge web application at legacy.portalbridge.com would be deprecated on June 30, 2026, becoming a redirect to the current Portal Bridge site, and that chain-specific functionality that existed only in the legacy app would no longer be reachable at that URL afterward. The notice is an operational/UX change affecting how users initiate transfers through the bridge rather than a change to this token's backing or contract, but users who still had pending transfers routed through the legacy interface were advised to complete them before the cutoff.","heading":"Portal legacy interface retirement (2026)","severity":"low","sources":[{"credibility":2,"name":"Wormhole — Sunsetting Portal Legacy: What You Need to Know","type":"official","url":"https://wormhole.com/blog/sunsetting-portal-legacy-what-you-need-to-know"}]},{"content":"Price-tracking pages for this mint report a market capitalization in roughly the $200 million to $400 million range and liquidity in the single-digit millions of dollars across major Solana decentralized exchanges, with one source reporting over 122,000 holders. Figures varied noticeably between sources and snapshots consulted for this investigation, which is consistent with normal market-data staleness/caching differences between trackers rather than evidence of manipulation, but it means any single cited figure should be treated as approximate rather than authoritative.","heading":"Current market footprint","severity":"low","sources":[{"credibility":2,"name":"Solflare — Wrapped BTC (Portal) price page","type":"other","url":"https://solflare.com/prices/wrapped-btc-portal/3NZ9JMVBmGAqocybic2c7LQCJScmgsAZ6vQqTDzcqmJh"},{"credibility":2,"name":"Coinranking — What is Wrapped BTC (Wormhole) (WBTC)?","type":"other","url":"https://coinranking.com/coin/FwSkN6za3+wrappedbtcwormhole-wbtc/about"}]}],"sources_used":[{"credibility":2,"name":"Solflare — Wrapped BTC (Portal) price page","type":"other","url":"https://solflare.com/prices/wrapped-btc-portal/3NZ9JMVBmGAqocybic2c7LQCJScmgsAZ6vQqTDzcqmJh"},{"credibility":2,"name":"Solflare — Wrapped BTC (Wormhole) price page","type":"other","url":"https://www.solflare.com/prices/wrapped-btc-wormhole/3NZ9JMVBmGAqocybic2c7LQCJScmgsAZ6vQqTDzcqmJh/"},{"credibility":3,"name":"MadeOnSol — token page","type":"other","url":"https://madeonsol.com/token/3NZ9JMVBmGAqocybic2c7LQCJScmgsAZ6vQqTDzcqmJh"},{"credibility":2,"name":"Coinranking — What is Wrapped BTC (Wormhole) (WBTC)?","type":"other","url":"https://coinranking.com/coin/FwSkN6za3+wrappedbtcwormhole-wbtc/about"},{"credibility":1,"name":"Security Affairs — Wormhole cryptocurrency platform hacked, crooks stole $326 million","type":"news_article","url":"https://securityaffairs.com/127570/cyber-crime/wormhole-hack.html"},{"credibility":2,"name":"web3isgoinggreat.com — Wormhole bridge hack entry","type":"research","url":"https://www.web3isgoinggreat.com/single/wormhole-bridge-hack"},{"credibility":2,"name":"Blockworks — Jump Crypto Just Counter-Exploited the Wormhole Hacker for $140 Million","type":"news_article","url":"https://blockworks.com/news/jump-crypto-wormhole-hack-recovery"},{"credibility":2,"name":"web3isgoinggreat.com — Oasis rewrites the rules for Jump Crypto to recover stolen assets","type":"research","url":"https://web3isgoinggreat.com/single/oasis-rewrites-the-rules-for-jump-crypto"},{"credibility":2,"name":"The Block — Wrapped tokens issued by FTX or Alameda collapsing, no longer redeemable","type":"news_article","url":"https://www.theblock.co/post/186326/wrapped-tokens-issued-by-ftx-or-alameda-collapsing-no-longer-redeemable"},{"credibility":2,"name":"The Defiant — FTX-Backed Bitcoin and Ether Tokens Depeg On Solana","type":"news_article","url":"https://thedefiant.io/news/cefi/solana-btc-eth-depeg"},{"credibility":2,"name":"Wormhole — Sunsetting Portal Legacy: What You Need to Know","type":"official","url":"https://wormhole.com/blog/sunsetting-portal-legacy-what-you-need-to-know"}],"summary":"Wrapped BTC (Portal) — also labeled \"Wrapped BTC (Wormhole)\" on some platforms — is a Solana SPL token at mint address 3NZ9JMVBmGAqocybic2c7LQCJScmgsAZ6vQqTDzcqmJh representing Bitcoin value bridged onto Solana via the Wormhole/Portal token bridge. It is a long-established, verified, widely held asset (reported holder counts over 100,000 and a market capitalization in the hundreds of millions of dollars), but as a multi-layer bridged and wrapped asset it carries inherent custodial and smart-contract risks, including exposure to the 2022 Wormhole bridge hack, that are distinct from holding native Bitcoin.","timeline":[{"date":"2022-02-02","date_evidence":"a Wormhole tweet is dated \"February 2, 2022.\"","event":"Attacker exploits a signature-verification flaw in the Wormhole Solana-Ethereum bridge, minting 120,000 unbacked wrapped ETH in a loss reported at roughly $325 million. The hack hit the bridge's wETH contract, not this WBTC token, but affected the same bridge infrastructure.","source":"Security Affairs","source_url":"https://securityaffairs.com/127570/cyber-crime/wormhole-hack.html"},{"date":"2022-11","event":"Following the FTX/Alameda bankruptcy filings, Sollet-bridged wrapped Bitcoin on Solana (soBTC) — a separate bridge product from the Wormhole/Portal token covered in this investigation — is widely reported as no longer redeemable and trading at a steep discount.","source":"The Block","source_url":"https://www.theblock.co/post/186326/wrapped-tokens-issued-by-ftx-or-alameda-collapsing-no-longer-redeemable"},{"date":"2023-02-21","date_evidence":"The order came from the High Court of England and Wales, dated February 21, 2023.","event":"Under a UK High Court order, Oasis exploits an admin-multisig vulnerability in its own platform to seize roughly $140 million in assets traced to the 2022 Wormhole hacker's wallet, returning them to an authorized third party.","source":"Blockworks","source_url":"https://blockworks.com/news/jump-crypto-wormhole-hack-recovery"},{"date":"2026-06","date_original":"2026-06-30","event":"Wormhole's legacy Portal Bridge web application (legacy.portalbridge.com) is deprecated and becomes a redirect to the current Portal Bridge interface.","source":"Wormhole blog","source_url":"https://wormhole.com/blog/sunsetting-portal-legacy-what-you-need-to-know"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 5beaa35c-adc7-4218-8294-e41225df44f2copy