Skip to main content
Sign in
xToken1 decision on this page

Audit log

Every state-changing event for xToken: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.

  1. #1publishby system:backfill
    2026-05-26 03:49:41Z
    Score: ?? (no score change)
    anchoranchored
    chain
    mainnet-betaslot 422,206,379
    sig
    c8wk4jm1etXR…tekSRCGhexplorer ↗
    hash
    GDWj4iVLKXqp…NvmQ7Ga7sha256 → base58
    verifying row…full verify ↗
    canonical bytes (6219 B) ▸
    {"actor":"system:backfill","investigation_id":"e1f52b35-22bd-40ff-b8ca-12bded5dbd8d","kind":"publish","page_slug":"xtoken","published_at":"2026-05-26T03:49:41.094Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"xToken","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://medium.com/xtoken/introducing-xtoken-2fd50d0f943b","type":"other","url":""},{"credibility":3,"name":"https://tracxn.com/d/companies/xtokenmarket/__dtK8Ocu4Lkbht1eagx29wYdwwxbeIzmi0c4gIV1rRX0","type":"other","url":""},{"credibility":3,"name":"https://www.defipulse.com/blog/founder-fireside-chat-with-michael-j-cohen-of-xtoken","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/markets/2021/05/12/defi-protocol-xtoken-suffers-245m-exploit","type":"other","url":""},{"credibility":3,"name":"https://www.theblock.co/post/104667/defi-protocol-xtoken-exploit-attack","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/xtoken-rekt","type":"other","url":""},{"credibility":3,"name":"https://medium.com/xtoken/initial-report-on-xbnta-xsnxa-exploit-d6e784387f8e","type":"other","url":""},{"credibility":3,"name":"https://web3isgoinggreat.com/?id=2021-05-12-0","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-xtoken-hack-august-2021","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/xtoken-rekt-x2","type":"other","url":""},{"credibility":3,"name":"https://medium.com/xtoken/xsnx-post-mortem-666d35071f38","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/beleaguered-defi-project-xtoken-suffers-second-major-exploit-since-may","type":"other","url":""},{"credibility":3,"name":"https://coingeek.com/xtoken-defi-protocol-loses-7m-in-yet-another-exploit/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://beincrypto.com/xtoken-proposes-compensation-after-25m-defi-hack/","type":"other","url":""},{"credibility":3,"name":"https://gov.xtoken.cafe/t/proposal-for-compensation-for-xtoken-hack/109","type":"other","url":""},{"credibility":3,"name":"https://coingeek.com/xtoken-defi-protocol-loses-7m-in-yet-another-exploit/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/xtoken-rekt","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-xtoken-hack-august-2021","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/xtoken-rekt-x2","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://beincrypto.com/xtoken-proposes-compensation-after-25m-defi-hack/","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/beleaguered-defi-project-xtoken-suffers-second-major-exploit-since-may","type":"other","url":""},{"credibility":3,"name":"https://medium.com/xtoken/xtoken-2-0-a8e8db69eefd","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/xtoken","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/xtoken-rekt","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/xtoken-rekt-x2","type":"other","url":""}]}],"sources_used":[],"summary":"xToken (XTK) was a DeFi protocol offering wrapped staking tokens and liquidity management on Ethereum, founded by Michael J. Cohen in 2020. The protocol suffered two major flash loan exploits in 2021 — a $24.5 million attack in May and a $4.5 million attack in August — resulting in total losses exceeding $29 million and the permanent retirement of its flagship xSNX product. The XTK governance token subsequently lost approximately 99.84% of its value, and compensation paid to victims was significantly below the amounts stolen.","timeline":[{"date":"2020-09-10","event":"xToken completes its first funding round, raising funds toward a total of $3 million across two rounds. Protocol founded by Michael J. Cohen in Brooklyn, NY.","source":""},{"date":"2021-05-12","event":"xToken suffers its first major exploit. An attacker borrows 61,833 ETH via dYdX flash loan and exploits vulnerabilities in both xBNTa (invalid mint path) and xSNXa (oracle manipulation via Uniswap v2 / Kyber). Approximately $24.5 million is drained from Bancor and Balancer liquidity pools. Assets stolen include ~2,400 ETH, 781,000 BNT, 407,000 SNX, and 1.9 billion xBNTa tokens. xToken pauses minting across all contracts.","source":""},{"date":"2021-05-16","event":"xToken proposes a compensation plan offering 1% of XTK supply to hack victims, vested over one year. Community feedback leads to an upward revision to 2% (~20 million tokens, worth approximately $3.84 million at prevailing prices — roughly 15% of the stolen amount).","source":""},{"date":"2021-08-29","event":"xToken suffers its second major exploit. An attacker exploits an access control bug in the xSNXAdmin callFunction (using `require(sender==address(this))` instead of verifying the dYdX flash loan caller). The attacker borrows 25,000 ETH from dYdX and 1 million SNX from Aave, manipulates SNX price, and extracts approximately $4.5 million from xSNX holders.","source":""},{"date":"2021-08-30","event":"xToken announces permanent retirement of the xSNX product and pledges a second XTK-based compensation program for affected users. XTK is trading at approximately $0.12, down ~90% from its April 2021 peak of ~$1.36.","source":""},{"date":"2022-03-01","event":"xToken launches xToken Terminal, a rebranded capital markets and liquidity management platform for Web3 projects, representing an attempted pivot away from staking token products.","source":""},{"date":"2024-01-01","event":"XTK token trades at approximately $0.0000244 — a decline of approximately 99.84% from its all-time high. Market capitalization falls below $10,000. Protocol never recovers meaningful total value locked (TVL).","source":""}]},"v":1}
    Verify offline (run on your own machine)
    python -m src.verify_decision 5d6d2eaf-734e-4e22-bece-a47233c13388
How verification works. The “Row integrity” check above is computed in your browser — your machine recomputes the SHA-256 of the canonical bytes and compares against the stored hash. No avoid.net server can fake that check. The “full verify” link goes one level deeper: your browser fetches the on-chain transaction from a Solana RPC node and confirms the same hash is in the memo. If you don’t want to trust either avoid.net or the public RPC, run the CLI verifier on your own machine — python -m src.verify_decision <event_id>.