{
 "fields": [
  {
   "field": "id",
   "type": "string",
   "how": "stated",
   "meaning": "Stable incident id (ht + hash of the first source record). Never reused. An id whose incident joined another one is listed in /data/id-aliases.json (old id: id now); its page redirects and /api/incidents?id= answers with merged_from."
  },
  {
   "field": "date",
   "type": "YYYY-MM-DD",
   "how": "merged",
   "meaning": "Date of the theft: the date most sources give; a confirmed attack transaction's block date wins."
  },
  {
   "field": "name",
   "type": "string",
   "how": "merged",
   "meaning": "Victim or project name, by source order DefiLlama, SlowMist, DeFiHackLabs, rekt.news, W3IGG, ack3."
  },
  {
   "field": "headline",
   "type": "true",
   "how": "stated",
   "meaning": "Only Web3 Is Going Great reports it, so the name is a news headline."
  },
  {
   "field": "kind",
   "type": "hack | phishing | scam | rugpull | collapse | fraud | other | followup",
   "how": "merged",
   "meaning": "What happened. A hack majority wins; legal news about an older theft is followup."
  },
  {
   "field": "theft",
   "type": "true",
   "how": "derived",
   "meaning": "kind is hack, phishing, scam or rugpull: the kinds in the stolen total."
  },
  {
   "field": "fam",
   "type": "keys | code | market | bridge | social | insider | other",
   "how": "derived",
   "meaning": "How the attacker got in, from the method labels."
  },
  {
   "field": "tech",
   "type": "string",
   "how": "stated",
   "meaning": "Method as the first source that names one states it."
  },
  {
   "field": "target",
   "type": "string",
   "how": "stated",
   "meaning": "The sources' own target label (DefiLlama, SlowMist, ack3), as written."
  },
  {
   "field": "tg",
   "type": "cex | defi | bridge | people | nft | chain | other",
   "how": "see tgc",
   "meaning": "What was attacked, seven classes."
  },
  {
   "field": "tgc",
   "type": "stated | matched | estimated",
   "how": "derived",
   "meaning": "How sure tg is: stated by a source, matched in DefiLlama's protocol list, or estimated by a rule. Drop estimated for strict work."
  },
  {
   "field": "tgb",
   "type": "string",
   "how": "derived",
   "meaning": "The rule or source behind tg."
  },
  {
   "field": "sec",
   "type": "string",
   "how": "matched",
   "meaning": "Sector from DefiLlama's protocol list (Lending, Dexs, CEX, Bridge ...)."
  },
  {
   "field": "secb",
   "type": "string",
   "how": "derived",
   "meaning": "How sec was found: the hack record's protocol id (exact) or a name and chain match (one protocol only)."
  },
  {
   "field": "chains",
   "type": "string[]",
   "how": "merged",
   "meaning": "Chains involved; a multi-chain incident lists all."
  },
  {
   "field": "usd",
   "type": "number",
   "how": "merged",
   "meaning": "Loss in US dollars at the time: median of three or more source figures, else one source's figure."
  },
  {
   "field": "lo, hi",
   "type": "number",
   "how": "merged",
   "meaning": "Lowest and highest dollar figure at the time across sources."
  },
  {
   "field": "lb",
   "type": "median | source name",
   "how": "derived",
   "meaning": "Where usd comes from."
  },
  {
   "field": "src[]",
   "type": "{s, u, v, b, d}",
   "how": "stated",
   "meaning": "Each source: s name, u link, v its own figure, b p (a coin amount priced here) or r (rekt.news leaderboard), d its date if different."
  },
  {
   "field": "ret",
   "type": "number",
   "how": "stated",
   "meaning": "Returned or recovered, as a source states it."
  },
  {
   "field": "out",
   "type": "{returned, recovered, frozen, covered, bounty_paid, back_w3}",
   "how": "stated",
   "meaning": "What happened to the money afterwards, with the sentence it was read from."
  },
  {
   "field": "conf",
   "type": "A | B | C",
   "how": "checked",
   "meaning": "A: two or more sources agree on date (3 days) and loss (25%). B: they disagree. C: one source."
  },
  {
   "field": "n",
   "type": "number",
   "how": "checked",
   "meaning": "Independent sources that report it."
  },
  {
   "field": "onchain",
   "type": "true",
   "how": "checked",
   "meaning": "An attack transaction was found on chain with a block date within 30 days."
  },
  {
   "field": "review",
   "type": "string[]",
   "how": "checked",
   "meaning": "Open questions: disagreements, possible duplicates, a huge loss from one source."
  },
  {
   "field": "nominal",
   "type": "{realized, by, ev}",
   "how": "stated",
   "meaning": "The listed loss is a face value of created tokens; out of totals."
  },
  {
   "field": "agg",
   "type": "string",
   "how": "derived",
   "meaning": "The headline sums many thefts (a period or many victims); out of totals."
  },
  {
   "field": "audit, audit_by",
   "type": "string",
   "how": "stated",
   "meaning": "Audit status and auditors as rekt.news or ack3 state it, with scope for ack3."
  },
  {
   "field": "law[]",
   "type": "{d, a, by, t, u}",
   "how": "checked",
   "meaning": "US DOJ and Treasury OFAC press releases linked to the incident; every link rule is documented."
  },
  {
   "field": "actor, attr, official",
   "type": "string, object",
   "how": "stated",
   "meaning": "Attribution and official loss, only from a law enforcement statement."
  },
  {
   "field": "desc",
   "type": "string",
   "how": "stated",
   "meaning": "Description from DefiLlama or SlowMist, addresses masked."
  }
 ],
 "counted_rule": "theft and not nominal and not agg and no 'single source' review reason",
 "how": {
  "stated": "a source gives it",
  "merged": "combined from sources by a fixed rule",
  "checked": "verified by this pipeline",
  "derived": "computed from stated values",
  "matched": "found in DefiLlama's protocol list",
  "estimated": "inferred by a rule; marked per row"
 }
}