Watchlist — every removal, downgrade, and open investigation.
The cases below are projects whose ratings have been suspended, downgraded, or revoked, and projects under active editorial review. Every entry is published with date, evidence sources, and where it exists, the project's response. Once an action is taken, it is never quietly reversed.
Total actions · all time
82
across 28 chains
Removed for cause
41
cannot be re-rated
Active watchlist
23
downgraded · unresolved
Under investigation
18
rating suspended
Resolved · last 30d
4
restored to active
May 20263 actions
EM
EmberSwap
DeFi · DEX·BNB Chain·0xb4a7…3F02
Downgraded · Watchlist
May 24, 2026 · 09:14 UTC
Score71 · Verified→42 · Watchlist−29 pts · all categories affectedAction signed · 0xA4E1…c8d2
Reason for action
Critical audit findings unresolved for 90+ days. The Halborn 2025 review identified two high-severity issues in the v3 router contract: a slippage-bypass vector and an oracle-staleness window. Onyx confirmed via on-chain analysis that the affected functions remain reachable from production.
Compounding this: the project's three known treasury wallets have not transmitted a transaction since 2026-02-14 (Q1), in violation of the financial transparency commitment made at the time of rating.
Open findings
2 high · 0 resolved
Days since last treasury tx
98 d
TVL · change since action
−47% in 72h
Active users · 7d
−68%
Project response
"We acknowledge receipt of the action. The findings cited remain under internal review by our development team and additional independent counsel. We dispute the characterization that production functions are reachable and will publish a technical response within seven days."
— EmberSwap Foundation · signed 0x82Cf…7a2B · May 24, 18:42 UTC
Score68 · Listed→RemovedRating revoked · cannot be re-ratedAction signed · 0xA4E1…c8d2
Reason for action
Team identity falsification. Two of the five publicly listed founders — "Andrei Kovalenko" and "Maya Patel-Sharma" — were not employed by NovaPlay at any point during the rating window. Onyx contacted the named individuals directly; both confirmed they had no relationship with the project. KYC documents on file with Onyx, supplied by NovaPlay at application, do not match passport records held by the relevant jurisdictions.
In accordance with Section 13 of the methodology, removal is the only available action when team identity is materially falsified. Once removed for cause, the rating cannot be reinstated. NovaPlay will not be re-rated under any methodology version, including by a successor entity using shared infrastructure.
Falsified identities
2 of 5
User funds at exposure
~$4.2M TVL
Token unlock — next 14d
$8.6M
Onyx exposure window
Aug 2025 – May 2026
No response received from project · 5 days elapsed since notification
Score74 · Verified→SuspendedRating held pending review · est. 14 dSuspension signed · 0xA4E1…c8d2
Open question
Anomalous on-chain agent volume. Onyx's monthly review of the AI Agents category identified that 78% of reported agent transactions on the Stratos network in April 2026 originate from 14 wallets — and those 14 wallets were all funded by the same source within a 9-hour window in March.
This is not, on its face, evidence of misconduct: it may reflect legitimate testing, market-making activity, or a single institutional integration. But it is inconsistent with the agent-diversity claims made at time of rating (Verified · Q1 2026). The rating is therefore suspended, not downgraded, pending response.
Concentration · top 14
78.4% of volume
Funding source
Single wallet · 9h window
Response deadline
May 29, 2026 · 14 d
Reviewer
Tomás Reyes · Infra lead
Project response · received May 17
"We are preparing a complete technical disclosure on the wallet activity in question. The transactions originate from our internal QA harness and a single institutional partner whose anonymity was contractually required at time of integration. We have requested permission to disclose; response by May 24."
— Stratos AI Labs · signed stratos.eth · May 17, 09:08 UTC
Reinstate at Verified if disclosure resolves the discrepancy. Downgrade to Listed or below if explanation is partial. Removal only if disclosure is refused.
Exit transaction by contract owner · $28.4M user funds drained. On Apr 21, 22:14 UTC, the HyperGain master vault contract was upgraded via a privileged-role call that transferred all user-deposited funds to a single externally-owned address. The address bridged the funds to Tornado Cash within 38 minutes.
Whether this is a private-key compromise or a deliberate exit is, at present, unknowable. The outcome — total loss of user funds with no remediation path — is the same in either case. Rating revoked; project will not be re-rated.
Funds drained
$28.4M
Time to bridge
38 minutes
Affected wallets
~14,200
Remediation
None offered
Project unreachable · all communication channels offline since incident
ScoreSuspended (Mar 2026)→71 · VerifiedReinstated at original tierAction signed · 0xA4E1…c8d2
Resolution summary
Investigation opened Mar 14, 2026 over concentration of moderation rights within a small set of admin wallets. Memecoin Maps published a multi-sig migration plan within 7 days, executed the migration on Apr 8, and the moderation power is now distributed across 7 signers including 3 external contributors. Rating reinstated at original Verified tier.
Project response
"We disagreed with the framing but agreed with the substance. The new multi-sig is live and the seven signers, including external contributors, are listed at maps.coin/sigs. We thank Onyx for raising the concern publicly rather than privately."
Score66 · Listed→SuspendedOpen 58 days · response receivedSuspension signed · 0xA4E1…c8d2
Open question
Oracle-manipulation exposure. On Mar 24, $4.1M of bad debt accumulated against the WETH/USDC vault during a 9-minute window in which the price feed (operated by a third party) deviated 8.4% from CEX consensus. Onyx is reviewing whether VaultAxis's oracle-staleness checks, as deployed, conform to the protections described at time of rating.
Project response · Mar 30
"The bad debt has been absorbed by the protocol reserve fund. No user lost principal. We have published a post-mortem and have begun migration to a dual-oracle architecture (Chainlink + RedStone). Migration ETA mid-April."
Case 2026-0024 · open 58 days · re-review scheduled May 30
Public ledger · machine-readable
The watchlist is a feed, not just a page.
Every action is published to a signed JSON feed and on-chain registry. Wallet-integrate to receive notifications when a project you've interacted with is downgraded, suspended, or removed.