Team doxx status

Methodology how we score #

**What this measures** This factor records the team's public identity disclosure level using a four-tier categorical scale: real-name doxxed, consistent-pseudonym-with-track-record, pseudonym-with-no-track-record, and fully anonymous. Measurement is manual OSINT by the curator, drawing on LinkedIn profiles, conference talk attributions, GitHub contributor history, prior employer references, and any post-exploit self-identification. Category 7 context: anonymity is not inherently a risk signal — many credible pseudonymous teams exist — but the absence of any accountability surface materially elevates the probability of exit-scam execution.

**Why it matters** Across the hack database, anonymous or pseudonymous-no-track-record teams appear repeatedly among protocols that experienced insider-driven drains. Beanstalk's founder trio doxed themselves only after a $181M governance exploit. Uranium Finance, Cashio, Harvest Finance, and MonoX all operated with unknown teams at the time of their exploits. Conversely, fully doxxed teams have a meaningful lower base rate of exit scams, because real-world identity creates legal accountability. The correlation is not causal — anonymous teams can run secure protocols — but the asymmetry matters for a risk signal.

**Green / Yellow / Red** Green is scored when at least two core team members are real-name identifiable with verifiable prior work history (LinkedIn, GitHub, prior employer reference). Yellow applies when the team operates under consistent pseudonyms with a demonstrable track record of prior successful protocol contributions — reputation substitutes partially for legal accountability. Red is scored when the team is fully anonymous with no track record, or uses pseudonyms created within the past 12 months with no prior attributable DeFi history.

**Common gray cases** Gray is assigned when the protocol operates with a DAO structure where contributor identity is distributed and no single "team" exists, or when the team is pseudonymous but the curator cannot assess track-record depth within the evidence budget.

**Notable historical examples** - **Beanstalk** ($181M, 2022): Founder trio operated as "Publius" (anonymous) until self-doxxing post-hack. - **Uranium Finance** ($57.2M, 2021): Fully anonymous team; GitHub deleted post-exploit. - **Cashio** ($48M, 2022): Partially anonymous team; team responded publicly after exploit. - **PancakeBunny** ($45M, 2021): Team identity unknown at time of exploit. - **Harvest Finance** ($33.8M, 2020): Anonymous dev team; 0xf00d deployer address only public identifier.

Measurement what to look for #

Classify each named team member as: real-name / consistent-pseudonym-with-track-record / pseudonym-no-track-record / fully-anonymous.

Data & output #

Scored protocols 80 carry this factor #

Linked hacks 65 historical incidents #