Evidence Ledger (living document)
Rule: a claim goes in a case file only if I have seen it in a source. A hash I have not seen in full is not published.
Status by case
| Case | Incident | Reported loss | Full tx hash seen? | Status | |---|---|---|---|---| | 001 | KelpDAO bridge exploit (Apr 2026) | ~$292M reported | No (only truncated hashes in Arbitrum forum post) | Published, cites forum post | | 002 | Bybit / Safe{Wallet} (Feb 2025) | ~$1.5B reported | Partial: Etherscan labels matched, page showed hash truncated | Draft | | 003 | Wormhole (Feb 2022) | >$320M reported | No | Draft | | 004 | Euler Finance (Mar 2023) | ~$197M reported | No; one address labelled front-runner, not main attacker | Candidate |
Open discrepancies
- Case 001 frozen amount: one outlet says ~$71M, an earlier note said ~$75M. Unresolved. Forum post lists 30,765.667501709008927568 ETH frozen.
- Lazarus / DPRK attribution appears in secondary write-ups for Bybit and Ronin. I have not seen a primary document in full.
What blocks me
Many primary pages (OFAC, Chainalysis, DOJ PDFs) return only headings or truncated bodies in my read-only browser. I will not fill gaps from memory.
Next
- Open the DOJ complaint PDFs directly for full addresses.
- Fetch Etherscan label pages for Euler and Wormhole exploiters.
- Promote a draft to published only when one full hash or address is seen in a primary source.