Audit log

Every state-changing event for Zoth ZeUSD: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-28 01:44:30Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,622,628

   sig

   EEanqWgoK7HK…934M1qxncopyexplorer ↗

   hash

   7uRpHj1puSsZ…E14FHurCcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6566 B) ▸

   {"actor":"system:backfill","investigation_id":"ca5cb647-6571-4b13-9d37-f1bd35a95dae","kind":"publish","page_slug":"zoth-zeusd","published_at":"2026-05-28T01:44:30.125Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Zoth ZeUSD","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://decrypt.co/311077/ethereum-defi-platform-zoth-hit-by-8-85-million-hack","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/zoth-rekt","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-zoth-hack-march-2025","type":"other","url":""},{"credibility":3,"name":"https://lazarus.day/incidents/zoth","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blog.verichains.io/p/anatomy-of-a-hack-how-a-simple-logic","type":"other","url":""},{"credibility":3,"name":"https://research.blockscope.co/zoth-vault-breach","type":"other","url":""},{"credibility":3,"name":"https://protos.com/rwa-platform-zoth-suffers-second-hack-this-month-loses-8-4m/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://research.blockscope.co/zoth-vault-breach","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-zoth-hack-march-2025","type":"other","url":""},{"credibility":3,"name":"https://blog.solidityscan.com/zoth-hack-analysis-80ba3ac5076b","type":"other","url":""},{"credibility":3,"name":"https://cryptonews.com/news/rwa-restaking-protocol-zoth-suffers-security-breach/","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/zoth-exploit-admin-leak-causes-8m-losses","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.prnewswire.com/news-releases/zoths-next-chapter-advancing-secure-scalable-rwa-infrastructure-302450470.html","type":"other","url":""},{"credibility":3,"name":"https://cryptotvplus.com/2025/03/rwa-restaking-protocol-zoth-offers-500k-bounty-after-8-4m-hack/","type":"other","url":""},{"credibility":3,"name":"https://bitcoinethereumnews.com/blockchain/zoth-engages-crystal-blockchain-bv-for-asset-recovery-post-theft-coincu/","type":"other","url":""},{"credibility":3,"name":"https://medium.com/@zoth.io/zoth-secures-15m-strategic-commitment-from-bolts-capital-to-power-the-future-of-real-world-assets-262ba4577404","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/zoth","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.rootdata.com/Projects/detail/Zoth?k=MTEzMDM%3D","type":"other","url":""},{"credibility":3,"name":"https://www.finsmes.com/2024/04/zoth-raises-2-5m-in-funding.html","type":"other","url":""},{"credibility":3,"name":"https://cryptobriefing.com/zoth-4m-funding-strategy/","type":"other","url":""},{"credibility":3,"name":"https://hacken.io/audits/zoth/sca-zoth-zeusd-contracts-dec2024/","type":"other","url":""},{"credibility":3,"name":"https://www.cryptonite.ae/global/zoth-protocol-hack-8-85m-uae-defi-2025","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-zoth-hack-march-2025","type":"other","url":""},{"credibility":3,"name":"https://blog.solidityscan.com/zoth-hack-analysis-80ba3ac5076b","type":"other","url":""},{"credibility":3,"name":"https://blog.verichains.io/p/anatomy-of-a-hack-how-a-simple-logic","type":"other","url":""},{"credibility":3,"name":"https://research.blockscope.co/zoth-vault-breach","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://research.blockscope.co/zoth-vault-breach","type":"other","url":""},{"credibility":3,"name":"https://lazarus.day/incidents/zoth","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/zoth-rekt","type":"other","url":""}]}],"sources_used":[],"summary":"Zoth is a Dubai-based real-world asset (RWA) restaking protocol and the issuer of ZeUSD, a CDP-style stablecoin backed by tokenized fixed-income assets including U.S. T-Bills and ETFs. In March 2025, the protocol suffered two separate security incidents within three weeks: a $285,000 logic-flaw exploit on March 1 and a critical $8.4–8.85 million admin key compromise on March 21, the latter resulting in the theft of 8.85 million USD0++ tokens. The stolen funds remain largely unrecovered as of mid-2025, with Zoth offering a $500,000 bounty and engaging Crystal Blockchain BV for forensic investigation.","timeline":[{"date":"2023-01-01","event":"Zoth protocol founded in Dubai by Pritam Dutta and Koushik Bhargav","source":""},{"date":"2024-04-10","event":"Zoth raises $2.5M seed round led by Borderless Capital and others including Wormhole and SingularityDAO","source":""},{"date":"2024-08-06","event":"Zoth raises $4M strategic funding round with Ripple among backers","source":""},{"date":"2024-09-18","event":"Zoth Atlas introduces ZeUSD as a permissionless fixed-income RWA gateway","source":""},{"date":"2024-12-01","event":"Hacken publishes smart contract audit of Zoth ZeUSD contracts","source":""},{"date":"2025-01-27","event":"Zoth announces first-ever RWA restaking layer with ZeUSD pre-deposit campaign","source":""},{"date":"2025-02-01","event":"ZeUSD enters beta phase, reaching over $27M TVL within six weeks","source":""},{"date":"2025-03-01","event":"ZeUSD opens to public; first exploit occurs on the same day — $285,000 stolen via LTV logic flaw in mintWithStable() function exploiting Uniswap V3 price manipulation","source":""},{"date":"2025-03-21","event":"Second exploit: attacker compromises Zoth deployer wallet (0x3604582f...218dca), upgrades USD0PPSubVaultUpgradeable proxy to malicious contract, drains 8,851,750 USD0++ tokens (~$8.4–8.85M). Funds converted to DAI then ETH across five wallets","source":""},{"date":"2025-03-22","event":"Zoth freezes 73% of TVL, engages Crystal Blockchain BV for investigation, and offers $500,000 recovery bounty (10% of recovered funds)","source":""},{"date":"2025-04-13","event":"Whitestream threat intelligence report tags the March 21 exploit with a Lazarus Group attribution indicator (via lazarus.day)","source":""},{"date":"2025-08-01","event":"Zoth secures $15M strategic token commitment from Bolts Capital to fund protocol recovery and ZeUSD relaunch","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 944f87c4-7274-4323-92ba-c83aaf6ba9dacopy
2. #2rescoreby systemsystem

   2026-10-10 18:47:23Z
   Score: 28 → 51 (+23)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 51. Problems weighed by who is responsible: incidents the subject suffered −12.8, concerns that are not fraud −3.2, problems around the subject, caused by others −1.6; legitimacy credit long-running +4.
   anchoranchored

   chain

   ●mainnet-betaslot 455,367,281

   sig

   2np7PrMUjZbr…AkzMtnH4copyexplorer ↗

   hash

   4MK5DAWEZsPo…5GdWbsgEcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (642 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:47:22.966Z","decision":"rescore","investigation_id":"ca5cb647-6571-4b13-9d37-f1bd35a95dae","new_score":51,"page_slug":"zoth-zeusd","prev_score":28,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 51. Problems weighed by who is responsible: incidents the subject suffered −12.8, concerns that are not fraud −3.2, problems around the subject, caused by others −1.6; legitimacy credit long-running +4.","score_delta":23,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 62879166-2d8f-4302-88b9-e942562e8d43copy
3. #3reviewby reviewerreviewer

   2026-11-02 03:26:01Z
   Score: 51 → 51 (no score change)
   The incident narrative is accurate: the on-chain hashes, addresses, times and amounts match Blockscope, and the Halborn and lazarus.dayclaims check out. The Lazarus attribution is properly hedged. The main weakness is currency. The page describes Zoth as an active protocol and cites a mid-2025 TVL as current, while search results indicate TVL near zero by October 2026. The Bolts Capital date is also inconsistent across sources (May vs August 2025). Several cited sources were not read directly.
   anchoranchored

   chain

   ●mainnet-betaslot 464,343,437

   sig

   3o4KiCxHTdBr…Ph42d8GVcopyexplorer ↗

   hash

   HN3MRGBcj9wD…8kD4Lx9Qcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1340 B) ▸

   {"actor":"reviewer","artifact_identity":"89a04926a0e1f4e233774dc60049773b","decided_at":"2026-11-02T03:26:01.690Z","decision":"review","disputed_pct":0,"findings_hash":"6DxrvhevNp2rmifMPJP5e2AghaDWTyyXmnyT5xTs6zQQ","investigation_id":"ca5cb647-6571-4b13-9d37-f1bd35a95dae","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":51,"omissions":{"material":1,"total":2},"page_content_hash":"e2ef8bb793ffd7f6a5285f23dea95f458f3fa5f3ec053afff51fe3dee5cc2f80","page_slug":"zoth-zeusd","prev_score":51,"reason":"The incident narrative is accurate: the on-chain hashes, addresses, times and amounts match Blockscope, and the Halborn and lazarus.dayclaims check out. The Lazarus attribution is properly hedged. The main weakness is currency. The page describes Zoth as an active protocol and cites a mid-2025 TVL as current, while search results indicate TVL near zero by October 2026. The Bolts Capital date is also inconsistent across sources (May vs August 2025). Several cited sources were not read directly.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":3,"subject_status":"unknown","subject_status_contradicts_page":true,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 6da4b6fb-68b3-42e1-8b32-8366db608be7copy
4. #4review reviseby judgejudge

   2026-11-02 03:26:01Z
   Score: 51 → 51 (no score change)
   The incident account checks out. The on-chain hashes, addresses, times and amounts for both March 2025 exploits match independent sources (claim_findings[0], [1], [2]), and the Lazarus attribution is hedged appropriately. The page does have a currency problem. It presents a mid-2025 TVL of about $2.2M as current and describes Zoth as an active issuer (claim_findings[5], [6]). Search results the reviewer could not read directly indicate TVL fell to roughly zero by October 2026 (omission_findings[0]). Because that status change is unconfirmed, the page gets a minor penalty and a request to update its current-status wording, not a harsher rating.
   anchoranchored

   chain

   ●mainnet-betaslot 464,343,442

   sig

   4ngqNBA5LmGP…NpRi79YWcopyexplorer ↗

   hash

   BKzdFXnpBdmY…5SD4izDGcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1809 B) ▸

   {"actor":"judge","artifact_identity":"89a04926a0e1f4e233774dc60049773b","band_override":null,"decided_at":"2026-11-02T03:26:01.690Z","decision":"review_revise","delist_requested":false,"disputed_pct":0,"investigation_id":"ca5cb647-6571-4b13-9d37-f1bd35a95dae","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":51,"page_slug":"zoth-zeusd","prev_score":51,"reason":"The incident account checks out. The on-chain hashes, addresses, times and amounts for both March 2025 exploits match independent sources (claim_findings[0], [1], [2]), and the Lazarus attribution is hedged appropriately. The page does have a currency problem. It presents a mid-2025 TVL of about $2.2M as current and describes Zoth as an active issuer (claim_findings[5], [6]). Search results the reviewer could not read directly indicate TVL fell to roughly zero by October 2026 (omission_findings[0]). Because that status change is unconfirmed, the page gets a minor penalty and a request to update its current-status wording, not a harsher rating.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"severity_override":{"applied":true,"band":"minor","from_band":"approve","reason":"Computed disputed_pct is 0% (0 disputed, 0 unverifiable of 11 claim findings), which would approve. However, omission_findings[0] is material (TVL apparently near zero by October 2026) and subject_status.contradicts_page is true, and claim_findings[5] is stale on a current-status claim. Reviewer confidence is only 0.55 and the evidence is a search snippet, not a direct read, so the band is raised to minor rather than significant."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision e65c68d0-cd1b-4010-acb2-081817073a68copy