Only IDAA Changes Status

No party — submitter, respondent, legal counsel, or regulator — can change a case status. Only IDAA, as the standards initiative, makes status determinations.

Proof Required for Every Change

Every status change requires documented evidence archived in the Vault. RESOLVED requires on-chain proof or signed settlement. No status change is made on assertion alone.

Immutable Status Log

Every status change is timestamped and archived in the 1CAD Vault. The full history is preserved permanently and cannot be altered retroactively.

Submitter Consent Required

A case enters the public registry only with explicit written consent. Without consent, only a Vault ID is published — no details, no parties, no amounts.

The submitter alleges that a crypto payment card provider (name withheld) retained 400 POL tokens belonging to an EU resident, citing blockchain irreversibility — while, according to the submitter, the assets remained in the provider's own controlled wallet.

IDAA has documented the submitter's evidence package, including the in-app disclosure, the technical explanation given and the potential MiCA questions raised. On-chain analytics referenced by the submitter indicate 410 POL present on the receiver wallet. A formal demand was submitted via legal counsel.

Resolution: On June 7, 2026, an on-chain transfer of 409.99 POL was received by the submitter's wallet, returning substantially all of the disputed assets. Status updated to RESOLVED on the basis of on-chain proof, in line with the 1CAD Case Lifecycle Standard.

No court, regulator, or respondent admission has established liability. The case is resolved by the return of assets only. Provider identity remains withheld; publication is for evidence-tracking purposes only.

Between April 7 and May 22, 2026, malicious actors exploited EIP-7702 (Ethereum "Pectra" hardfork), deploying 38 distinct phishing kits using the new 0x04 transaction type. This primitive allows an EOA to temporarily delegate code execution to a smart contract — effectively handing full wallet control to an attacker for 24 hours.

The critical failure: MetaMask v12.4 and earlier displayed these high-risk code-delegation requests as standard "Sign-in with Ethereum" prompts — with no warning, no simulation, and no visual distinction from a routine login. Retail users with extensive DeFi experience signed away total account control without knowing it.

Once bonded, automated on-chain drainers executed batched multicall sweeps — clearing ERC-20 balances, liquidating NFTs (including CryptoPunks at 35% below floor), and force-unwinding liquid staking positions via flash-loan loops. Median time from signature to empty wallet: 47 minutes. Fastest recorded drain ($1.2M): 11 minutes.

Capital was laundered through Across, Stargate, and THORChain into non-KYC exchanges within 6 hours. Emergency patches (MetaMask v12.5+, Rabby v0.97+) were deployed in late May 2026 — after $58.7M in user assets were already unrecoverable.

IDAA is reviewing this incident across all dimensions where the 1CAD Protocol may provide practical assistance to those affected. This includes preparation of the five-document compliance package to support victims in interactions with banks, tax authorities, and financial institutions — helping establish documented loss evidence, reduce adverse tax treatment of drained assets, and build a structured record for any future recovery or legal proceedings. Analysis is also being conducted on systemic prevention — what standards, disclosure requirements, and verification frameworks could reduce the impact of similar incidents going forward. No formal determination has been made. Analysis ongoing.