Generated by tools/build_backlog.py on 2026-05-26. Regenerated on every npm run site:data.
Scope: 621 worked examples, 144 Techniques, 19 Threat Actors.
This file is a prioritized contributor backlog. P0 items close hard structural gaps (empty Tactics, placeholder actor cards). P1 items lift per-Tactic coverage below the documented minimum. P2 items anchor candidate sub-Techniques from TAXONOMY-GAPS.md.
Before researching a candidate incident, run python3 tools/check_known.py "<description>" to avoid duplicating an existing entry.
Each (Tactic, year) cell below has zero documented incidents despite the Tactic being active in that year. Closing these is the highest leverage for matrix completeness.
- no empty cells in active years
- all actor cards have at least one attributed example
- all sub-Techniques have at least one referencing example
Tactics where the documented incident count for an active year falls below the target threshold (see COVERAGE-TARGETS.md).
- T1 × 2021 (Token Genesis) — 4 / target ≥5
- T1 × 2026 (Token Genesis) — 2 / target ≥5
- T2 × 2026 (Liquidity Establishment) — 1 / target ≥3
- T4 × 2026 (Access Acquisition) — 3 / target ≥4
- T7 × 2026 (Laundering) — 2 / target ≥4
- T8 × 2026 (Operator Continuity / Attribution Signals) — 2 / target ≥3
- T12 × 2026 (NFT-Specific) — 1 / target ≥2
- T13 × 2026 (Account Abstraction) — 2 / target ≥3
- T14 × 2026 (Validator / Staking) — 2 / target ≥3
- T15 × 2026 (Off-chain Entry-Vector / Pre-Positioning) — 1 / target ≥3
- T16 × 2026 (Governance / Voting Manipulation) — 1 / target ≥2
Sub-Technique IDs proposed in TAXONOMY-GAPS.md but not yet referenced by any worked example. Promoting these to emerging requires at least one anchor case.
- all candidates are either anchored or already promoted
- Pick a P0 / P1 / P2 line item that matches your research interest.
- Run
python3 tools/check_known.py "<incident description>"against your candidate to confirm it isn't already documented. - Open a GitHub issue with the line item title (e.g.
[backlog] T13 × 2024 — paymaster compromise candidate) so others can see what's claimed. - Submit a PR per CONTRIBUTING.md. The PR template has a Checklist that runs the validators locally.