Methodology

• Confirmed on-chain. We read it ourselves from a public node: a transaction, a balance change, a contract's code or state.
• Official statement. Stated by the project or its team. Not independently checked unless another level says so.
• Independent analysis. A named security firm or researcher. We prefer two that agree.
• Repository claim. What a public reproduction file or dataset entry says. A claim, not proof.
• Unverified. Seen, not confirmed.

Each record has three levels: one for the event, one for the root cause and one for the loss. Inside a record, individual statements are tagged verified, reported, estimate, hypothesis or unknown, so a number from an alert is never presented as a fact.

Native amounts come from transactions where we have them. Dollar values are the ones sources state, at their pricing, and we say which. We never add amounts across currencies, never net recoveries against losses, and unknown stays unknown rather than zero. Dashboard totals add only source-stated dollar figures and print how many records they cover.

A record is indexed by search engines only when it is published, has a root cause we verified, has at least one source and has enough written content (a timeline, a root cause and an impact statement). Right now that is 12 of 16 records. Others stay published for readers but are marked noindex and left out of the sitemap. Contract, transaction, search, alert and PoC index pages are noindex by default because they are mostly lookups.

Public reproduction files from the DeFiHackLabs repository (Apache-2.0) are shown verbatim in our on-site reader, as published in that public repository at the commit we pin. We keep the original licence header, path, commit and blob hash so you can check the file yourself. Shared test helpers and defensive patterns we write are also shown. There are 498 code entries.

ThreatWire never runs any of this code. Every code page states that we have not executed it and that it is for defensive research only: verify the blob, check the licence, and do not run it against live contracts without your own review.

Public test and reproduction files come from the DeFiHackLabs repository, licensed Apache-2.0, pinned to a specific commit. We store the verbatim file content locally for the reader, plus facts about each file (path, commit, blob hash, header licence, size). Attribution is in the repository NOTICE file. A file's own SPDX header can differ from the repository licence; we record each one.

The public dataset is updated automatically each week from DeFiHackLabs (GitHub Actions opens a pull request with new entries, verbatim files and addresses or transactions listed in those files). Entries stay unreviewed and noindex until a human verifies them. Analysed incidents are never auto-published. The last import read 892 entries at commit 7363f76db51f. Alerts and open items are checked manually when we revisit a record.

Coverage is small compared with the whole dataset and is not a statistical sample. On-chain checks use public nodes and are read-only. A chain explorer link appears only for chains whose explorer we have configured. Some older sources are listed without a link because we had not stored a verified URL.

Sources and provenance · Corrections