Audit log

Every state-changing event for xToken: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-26 03:49:41Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,206,379

   sig

   c8wk4jm1etXR…tekSRCGhcopyexplorer ↗

   hash

   GDWj4iVLKXqp…NvmQ7Ga7copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6219 B) ▸

   {"actor":"system:backfill","investigation_id":"e1f52b35-22bd-40ff-b8ca-12bded5dbd8d","kind":"publish","page_slug":"xtoken","published_at":"2026-05-26T03:49:41.094Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"xToken","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://medium.com/xtoken/introducing-xtoken-2fd50d0f943b","type":"other","url":""},{"credibility":3,"name":"https://tracxn.com/d/companies/xtokenmarket/__dtK8Ocu4Lkbht1eagx29wYdwwxbeIzmi0c4gIV1rRX0","type":"other","url":""},{"credibility":3,"name":"https://www.defipulse.com/blog/founder-fireside-chat-with-michael-j-cohen-of-xtoken","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/markets/2021/05/12/defi-protocol-xtoken-suffers-245m-exploit","type":"other","url":""},{"credibility":3,"name":"https://www.theblock.co/post/104667/defi-protocol-xtoken-exploit-attack","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/xtoken-rekt","type":"other","url":""},{"credibility":3,"name":"https://medium.com/xtoken/initial-report-on-xbnta-xsnxa-exploit-d6e784387f8e","type":"other","url":""},{"credibility":3,"name":"https://web3isgoinggreat.com/?id=2021-05-12-0","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-xtoken-hack-august-2021","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/xtoken-rekt-x2","type":"other","url":""},{"credibility":3,"name":"https://medium.com/xtoken/xsnx-post-mortem-666d35071f38","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/beleaguered-defi-project-xtoken-suffers-second-major-exploit-since-may","type":"other","url":""},{"credibility":3,"name":"https://coingeek.com/xtoken-defi-protocol-loses-7m-in-yet-another-exploit/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://beincrypto.com/xtoken-proposes-compensation-after-25m-defi-hack/","type":"other","url":""},{"credibility":3,"name":"https://gov.xtoken.cafe/t/proposal-for-compensation-for-xtoken-hack/109","type":"other","url":""},{"credibility":3,"name":"https://coingeek.com/xtoken-defi-protocol-loses-7m-in-yet-another-exploit/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/xtoken-rekt","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-xtoken-hack-august-2021","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/xtoken-rekt-x2","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://beincrypto.com/xtoken-proposes-compensation-after-25m-defi-hack/","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/beleaguered-defi-project-xtoken-suffers-second-major-exploit-since-may","type":"other","url":""},{"credibility":3,"name":"https://medium.com/xtoken/xtoken-2-0-a8e8db69eefd","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/xtoken","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/xtoken-rekt","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/xtoken-rekt-x2","type":"other","url":""}]}],"sources_used":[],"summary":"xToken (XTK) was a DeFi protocol offering wrapped staking tokens and liquidity management on Ethereum, founded by Michael J. Cohen in 2020. The protocol suffered two major flash loan exploits in 2021 — a $24.5 million attack in May and a $4.5 million attack in August — resulting in total losses exceeding $29 million and the permanent retirement of its flagship xSNX product. The XTK governance token subsequently lost approximately 99.84% of its value, and compensation paid to victims was significantly below the amounts stolen.","timeline":[{"date":"2020-09-10","event":"xToken completes its first funding round, raising funds toward a total of $3 million across two rounds. Protocol founded by Michael J. Cohen in Brooklyn, NY.","source":""},{"date":"2021-05-12","event":"xToken suffers its first major exploit. An attacker borrows 61,833 ETH via dYdX flash loan and exploits vulnerabilities in both xBNTa (invalid mint path) and xSNXa (oracle manipulation via Uniswap v2 / Kyber). Approximately $24.5 million is drained from Bancor and Balancer liquidity pools. Assets stolen include ~2,400 ETH, 781,000 BNT, 407,000 SNX, and 1.9 billion xBNTa tokens. xToken pauses minting across all contracts.","source":""},{"date":"2021-05-16","event":"xToken proposes a compensation plan offering 1% of XTK supply to hack victims, vested over one year. Community feedback leads to an upward revision to 2% (~20 million tokens, worth approximately $3.84 million at prevailing prices — roughly 15% of the stolen amount).","source":""},{"date":"2021-08-29","event":"xToken suffers its second major exploit. An attacker exploits an access control bug in the xSNXAdmin callFunction (using `require(sender==address(this))` instead of verifying the dYdX flash loan caller). The attacker borrows 25,000 ETH from dYdX and 1 million SNX from Aave, manipulates SNX price, and extracts approximately $4.5 million from xSNX holders.","source":""},{"date":"2021-08-30","event":"xToken announces permanent retirement of the xSNX product and pledges a second XTK-based compensation program for affected users. XTK is trading at approximately $0.12, down ~90% from its April 2021 peak of ~$1.36.","source":""},{"date":"2022-03-01","event":"xToken launches xToken Terminal, a rebranded capital markets and liquidity management platform for Web3 projects, representing an attempted pivot away from staking token products.","source":""},{"date":"2024-01-01","event":"XTK token trades at approximately $0.0000244 — a decline of approximately 99.84% from its all-time high. Market capitalization falls below $10,000. Protocol never recovers meaningful total value locked (TVL).","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 5d6d2eaf-734e-4e22-bece-a47233c13388copy
2. #2rescoreby systemsystem

   2026-10-10 18:49:30Z
   Score: 10 → 56 (+46)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 56. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −6.4, problems around the subject, caused by others −2.4; legitimacy credit long-running +6.
   anchoranchored

   chain

   ●mainnet-betaslot 455,369,550

   sig

   579nsjJJhdic…FBVZREo9copyexplorer ↗

   hash

   4MumTNuxRpDn…DxGXPjmFcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (637 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:49:30.360Z","decision":"rescore","investigation_id":"e1f52b35-22bd-40ff-b8ca-12bded5dbd8d","new_score":56,"page_slug":"xtoken","prev_score":10,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 56. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −6.4, problems around the subject, caused by others −2.4; legitimacy credit long-running +6.","score_delta":46,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 04ceab08-78bd-42ba-9def-4e8ef8b2eb93copy
3. #3reviewby reviewerreviewer

   2026-11-02 09:29:23Z
   Score: 56 → 56 (no score change)
   The core exploit facts (amounts, flash loan sizes, asset breakdown, access-control flaw, audit timing) match rekt.news and Halborn. Weak points are the unsourced ZachXBT flag and 10/100 trust score, a 99.84% figure that does not match the stated price, and the unverified compensation and price data. Current status was not established. Only a few sources were fetched.
   anchoranchored

   chain

   ●mainnet-betaslot 464,445,310

   sig

   RPoCPw4FXPaU…7jSjR9ntcopyexplorer ↗

   hash

   6JTK4ZrULk2D…dRdvmAogcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1212 B) ▸

   {"actor":"reviewer","artifact_identity":"b0265ece28da6c02567ccaa93db093c5","blocked_count":1,"decided_at":"2026-11-02T09:29:23.588Z","decision":"review","disputed_pct":0.2857,"findings_hash":"8wkyUC3E7jYz2X4frZNwAtkeArdjuu8PQeS3HT94jsdL","investigation_id":"e1f52b35-22bd-40ff-b8ca-12bded5dbd8d","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":56,"page_content_hash":"2948e411ef33838d7a5145a603ccd983425836104d82ae889b47502ec51397b2","page_slug":"xtoken","prev_score":56,"reason":"The core exploit facts (amounts, flash loan sizes, asset breakdown, access-control flaw, audit timing) match rekt.news and Halborn. Weak points are the unsourced ZachXBT flag and 10/100 trust score, a 99.84% figure that does not match the stated price, and the unverified compensation and price data. Current status was not established. Only a few sources were fetched.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":7,"sequence_num":3,"subject_status":"unknown","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 68aeab21-6b1a-47f4-8fe2-4f20ef675104copy
4. #4review reviseby judgejudge

   2026-11-02 09:29:23Z
   Score: 56 → 56 (no score change)
   The core facts of both 2021 exploits (loan sizes, stolen assets, the access-control flaw and the audit timing) were confirmed against rekt.news and Halborn (claim_findings[0-4]). About 29% of checkable claims could not be verified: the ZachXBT flag and 10/100 trust score have no supporting source (claim_findings[5]), and the 99.84% token decline does not match the stated price of $0.0000244 against a roughly $1.36 peak (claim_findings[6]). The compensation figures could not be checked because the source was blocked, so they were left out of the percentage. The page also does not establish whether the protocol is still operating, a high-priority gap. Reviewer confidence was moderate, so the penalty stays at the lower end of the minor band.
   anchoranchored

   chain

   ●mainnet-betaslot 464,445,314

   sig

   cqmUyLCj9Ddi…HQR1TynYcopyexplorer ↗

   hash

   CDL4ei42UkVj…SuzSMo4Ycopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1424 B) ▸

   {"actor":"judge","artifact_identity":"b0265ece28da6c02567ccaa93db093c5","band_override":null,"blocked_count":1,"decided_at":"2026-11-02T09:29:23.588Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.2857,"investigation_id":"e1f52b35-22bd-40ff-b8ca-12bded5dbd8d","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":56,"page_slug":"xtoken","prev_score":56,"reason":"The core facts of both 2021 exploits (loan sizes, stolen assets, the access-control flaw and the audit timing) were confirmed against rekt.news and Halborn (claim_findings[0-4]). About 29% of checkable claims could not be verified: the ZachXBT flag and 10/100 trust score have no supporting source (claim_findings[5]), and the 99.84% token decline does not match the stated price of $0.0000244 against a roughly $1.36 peak (claim_findings[6]). The compensation figures could not be checked because the source was blocked, so they were left out of the percentage. The page also does not establish whether the protocol is still operating, a high-priority gap. Reviewer confidence was moderate, so the penalty stays at the lower end of the minor band.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":7,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 67c78206-d524-4eb6-8307-a96dad327b1bcopy
5. #5rescoreby systemsystem

   2026-11-02 09:29:24Z
   Score: 56 → 60 (+4)
   Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 56 → 60. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −3.2, problems around the subject, caused by others −1.6; legitimacy credit long-running +6; 2 section(s) set aside until a failed fact-check is resolved.
   anchoranchored

   chain

   ●mainnet-betaslot 464,445,319

   sig

   5hiJ6gqULySH…Fp9psMHTcopyexplorer ↗

   hash

   CyWGhWg5WCz8…awjn6EYpcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (747 B) ▸

   {"actor":"system","decided_at":"2026-11-02T09:29:23.588Z","decision":"rescore","investigation_id":"e1f52b35-22bd-40ff-b8ca-12bded5dbd8d","new_score":60,"page_slug":"xtoken","prev_score":56,"reason":"Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 56 → 60. Problems weighed by who is responsible: incidents the subject suffered −6.4, concerns that are not fraud −3.2, problems around the subject, caused by others −1.6; legitimacy credit long-running +6; 2 section(s) set aside until a failed fact-check is resolved.","score_delta":4,"score_model":"v2","sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision b5efb778-9cc6-4aa8-acb7-16b82c5a4b71copy