{"investigation":{"slug":"betterbank","entity_name":"BetterBank","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"BetterBank is a DeFi lending and borrowing protocol built on PulseChain, launched in August 2025, offering a dual-token system (ESTEEM and FAVOR) with high-yield savings and LP-backed credit. Approximately three weeks after launch, the protocol suffered a $5 million exploit on August 26-27, 2025, caused by an unvalidated bonus reward minting function that had been flagged as a critical vulnerability by auditor Zokyo one month prior but was downgraded to 'Informational' severity and left unpatched by the team. The attacker returned approximately $2.7 million following on-chain negotiations, leaving a net loss of roughly $1.4 million; the protocol subsequently froze trading and announced relaunch plans.","sections":[{"content":"BetterBank is a decentralized finance protocol deployed on PulseChain, described by the team as a hybrid of traditional finance structure and DeFi composability. It launched on or around August 1, 2025, approximately three weeks before the exploit. The protocol consists of four components: Stronghold (a yield-bearing savings vault for PLS, PLSX, and pDAI); Wildlands (a credit market allowing users to borrow against LP-backed FAVOR); FAVOR (tokenized credit collateralized by liquidity positions); and ESTEEM (a share token distributed as a bonus reward to protocol participants). Native token ESTEEM was advertised as yielding 50-72% APY for stakers of PLS, PLSX, or pDAI. A co-founder operating under the pseudonym LBdefi is reported to have previously held co-founder roles at Solidus Money and Grape Finance — both projects that subsequently showed minimal social media activity as of 2025.","heading":"Protocol Overview","sources":[{"url":"https://rekt.news/betterbank-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://betterbanks-organization.gitbook.io/better-bank","name":"betterbanks-organization.gitbook.io","type":"other","credibility":3},{"url":"https://defillama.com/protocol/betterbank","name":"defillama.com","type":"other","credibility":3},{"url":"https://dappradar.com/dapp/betterbank/about","name":"dappradar.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On August 26-27, 2025, BetterBank was exploited for approximately $5 million in user assets — about three weeks after its public launch. The attacker's primary wallet (0x48c9f537f3f1a2c95c46891332E05dA0D268869B) was funded via Tornado Cash ($450 in seed funds), indicating premeditation. A secondary bridging address (0xf3BA0D57129Efd8111E14e78c674c7c10254acAE) was used to move funds.\n\nThe attack exploited a fundamental design flaw in the protocol's bonus reward logic. The core vulnerable function, swapExactTokensForFavorAndTrackBonus in FavorRouterWrapper.sol, was designed to mint ESTEEM reward tokens whenever a swap produced FAVOR tokens as output. Critically, the function validated only that FAVOR appeared as swap output but did not verify that the swap occurred within a legitimate, whitelisted liquidity pool.\n\nThe attacker exploited this by: (1) borrowing 50 million DAI via flash loan; (2) draining the legitimate DAI-PDAIF pool of approximately 1.09 billion DAI and 500 million PDAIF; (3) deploying a worthless ERC-20 token and creating an illegitimate liquidity pool pairing it with PDAIF on PulseXFactory; (4) executing approximately 20 rounds of swaps through the fraudulent pool to trigger unlimited ESTEEM minting while bypassing the 50% sell tax that applied only to recognized pairs; (5) converting accumulated ESTEEM rewards into approximately 3.8 billion additional PDAIF tokens; (6) reinserting the inflated PDAIF at a deliberate price imbalance into the legitimate pool, enabling extraction of approximately 891 million DAI; and (7) repaying the flash loan while retaining roughly 891 million DAI, 9.05 billion PLSX, and 7.40 billion WPLS.\n\nTotal initial losses were approximately $5 million. Following on-chain negotiations, the attacker returned 550 million pDAI (approximately $2.7 million) on August 27, 2025, reducing the net loss to approximately $1.4 million. Approximately 309 ETH was converted and moved toward Tornado Cash by the attacker, representing the portion retained.","heading":"The August 2025 Exploit","sources":[{"url":"https://rekt.news/betterbank-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://securelist.com/betterbank-defi-protocol-esteem-token-bonus-minting/117822/","name":"securelist.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/single/betterbank-exploit","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-betterbank-hack-august-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://olympixai.medium.com/post-mortem-betterbank-5m-exploit-august-2025-1e8657209842","name":"olympixai.medium.com","type":"other","credibility":3},{"url":"https://www.quillaudits.com/blog/hack-analysis/betterbank-exploit","name":"quillaudits.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In July 2025, approximately one month before the exploit and before public launch, BetterBank engaged cybersecurity firm Zokyo to audit its smart contracts. Zokyo's audit report explicitly identified the vulnerability later used in the attack under the finding title: 'A Malicious User Can Trade Bogus Tokens To Qualify For Bonus Favor Through The UniswapWrapper.' Zokyo also identified a related risk concerning 'flash loan exploitation of the Favor Bonus system.'\n\nHowever, Zokyo's proof-of-concept for the vulnerability used test Ether and legitimate tokens rather than worthless tokens, which obscured the full economic exploitability of the flaw. As a result, the BetterBank team downgraded the finding's severity to 'Informational' (in some sources described as 'Low') and classified it as 'Resolved' in the audit report without implementing the patched code provided by the auditor.\n\nAfter the exploit, a public dispute emerged between BetterBank and Zokyo over responsibility. BetterBank stated that the auditors had 'either not identified or failed to communicate the true severity of the flaw.' Zokyo maintained that the vulnerability had been clearly flagged. Multiple independent post-mortem analyses — from Halborn, Olympix, QuillAudits, and Securelist — concluded that the critical finding was present in the audit report and that the BetterBank team's decision not to patch it was the proximate cause of the loss.","heading":"Audit Failure and Disputed Responsibility","sources":[{"url":"https://rekt.news/betterbank-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://securelist.com/betterbank-defi-protocol-esteem-token-bonus-minting/117822/","name":"securelist.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-betterbank-hack-august-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://olympixai.medium.com/post-mortem-betterbank-5m-exploit-august-2025-1e8657209842","name":"olympixai.medium.com","type":"other","credibility":3},{"url":"https://www.quillaudits.com/blog/hack-analysis/betterbank-exploit","name":"quillaudits.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/single/betterbank-exploit","name":"web3isgoinggreat.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, the BetterBank team took several remediation steps. The team froze all FAVOR liquidity pools to prevent further losses. On-chain negotiations with the attacker resulted in the return of 550 million pDAI (approximately $2.7 million) on August 27, 2025. The team announced a 20% bounty for information leading to identification of the attacker.\n\nThe team subsequently published a recovery plan including: patching the identified smart contract vulnerabilities; relaunching new ESTEEM and FAVOR contracts with airdrops to verified legitimate holders; using treasury reserves and recovered LP assets to forgive outstanding debt; and stabilizing the protocol before resuming normal operations. As of the available reporting, PulseX tokens fell over 15% in the immediate aftermath of the exploit. BetterBank's total liquidity fell to $7.96 million following the incident.\n\nNo formal regulatory action, law enforcement referral, or on-chain identification of the attacker has been publicly confirmed in available sources.","heading":"Team Response and Recovery Efforts","sources":[{"url":"https://rekt.news/betterbank-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://securelist.com/betterbank-defi-protocol-esteem-token-bonus-minting/117822/","name":"securelist.com","type":"other","credibility":3},{"url":"https://www.quillaudits.com/blog/hack-analysis/betterbank-exploit","name":"quillaudits.com","type":"other","credibility":3},{"url":"https://olympixai.medium.com/post-mortem-betterbank-5m-exploit-august-2025-1e8657209842","name":"olympixai.medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"BetterBank's team operates pseudonymously. The most prominent identified team member is a co-founder who uses the handle 'LBdefi' on social media, with a disclosed background as co-founder of two earlier DeFi projects: Solidus Money and Grape Finance. Both prior projects showed limited post-2023 activity based on available social media and news records, suggesting modest traction. No team members are known to have been publicly doxxed, and no formal legal identity has been associated with the protocol in publicly available sources.\n\nThe protocol launched on PulseChain, a network founded by Richard Heart and associated with a broader ecosystem that has itself attracted regulatory scrutiny (Heart and PulseChain are separately under SEC enforcement action). BetterBank does not appear to have any direct legal or operational connection to Richard Heart or Hex/PulseChain corporate entities beyond being deployed on the PulseChain network.","heading":"Team Anonymity and Prior Project History","sources":[{"url":"https://rekt.news/betterbank-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://dappradar.com/dapp/betterbank/about","name":"dappradar.com","type":"other","credibility":3}],"severity":"medium"},{"content":"BetterBank has been flagged by on-chain investigator ZachXBT, whose prior investigations of DeFi protocols have frequently preceded or coincided with exploit disclosures and fraud findings. The specific basis for ZachXBT's flag of BetterBank is not fully documented in publicly available sources; the available reporting primarily connects ZachXBT to the broader context of the August 2025 exploit coverage rather than a pre-exploit warning. Rekt News, which regularly collaborates with ZachXBT and covers protocols he flags, published a dedicated analysis of the BetterBank exploit. The nature and timing of ZachXBT's flag relative to the exploit is low-confidence based on available sourcing.","heading":"ZachXBT Flag","sources":[{"url":"https://rekt.news/betterbank-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/single/betterbank-exploit","name":"web3isgoinggreat.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Based on available evidence, the following risk factors have been identified for BetterBank: (1) A confirmed $5 million exploit occurred approximately three weeks after protocol launch, resulting in a net loss of approximately $1.4 million after partial attacker restitution. (2) The exploited vulnerability was explicitly identified in a pre-launch security audit and was knowingly left unpatched by the development team. (3) The protocol was launched with an unpatched critical vulnerability, suggesting inadequate security review processes or risk management. (4) The team is pseudonymous with no publicly known legal identities. (5) Prior projects associated with the pseudonymous co-founder (LBdefi) showed limited longevity. (6) Attacker premeditation is evidenced by Tornado Cash seed funding. (7) The protocol's high advertised APY (50-72%) on savings products is characteristic of elevated risk DeFi mechanisms. (8) The protocol was flagged by ZachXBT, a credible on-chain investigator with a strong track record of identifying high-risk protocols.","heading":"Risk Factors Summary","sources":[{"url":"https://rekt.news/betterbank-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://securelist.com/betterbank-defi-protocol-esteem-token-bonus-minting/117822/","name":"securelist.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-betterbank-hack-august-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://olympixai.medium.com/post-mortem-betterbank-5m-exploit-august-2025-1e8657209842","name":"olympixai.medium.com","type":"other","credibility":3},{"url":"https://www.quillaudits.com/blog/hack-analysis/betterbank-exploit","name":"quillaudits.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2025-07","event":"BetterBank launches on PulseChain offering high-yield savings and LP-backed credit via the ESTEEM and FAVOR dual-token system.","source":"","date_original":"2025-07-01"},{"date":"2025-07","event":"Zokyo security audit conducted approximately one month before the exploit. Audit identifies critical vulnerability: 'A Malicious User Can Trade Bogus Tokens To Qualify For Bonus Favor Through The UniswapWrapper.' BetterBank team downgrades severity to Informational and does not implement the provided patch.","source":"","date_original":"2025-07-01"},{"date":"2025-08-26","event":"Exploit begins. Attacker (primary address 0x48c9f537f3f1a2c95c46891332E05dA0D268869B, funded via Tornado Cash) deploys three custom contracts, creates fraudulent liquidity pools, and begins draining BetterBank's FAVOR and ESTEEM reward system via unauthorized bonus minting.","source":""},{"date":"2025-08-27","event":"Exploit concludes. Approximately $5 million in user funds drained: 891 million DAI, 9.05 billion PLSX, 7.40 billion WPLS. BetterBank freezes all FAVOR pools. On-chain negotiations with the attacker begin.","source":""},{"date":"2025-08-27","event":"Attacker returns 550 million pDAI (approximately $2.7 million) to the protocol. Net loss confirmed at approximately $1.4 million. Approximately 309 ETH moved toward Tornado Cash by attacker.","source":""},{"date":"2025-08-27","event":"BetterBank announces post-exploit recovery plan: contract patches, relaunch of ESTEEM and FAVOR with airdrops to legitimate holders, debt forgiveness using treasury reserves. 20% bounty announced for attacker identification.","source":""},{"date":"2025-08-28","event":"Multiple security firms (Halborn, QuillAudits, Olympix, Securelist, Rekt News) publish post-mortem analyses concluding that Zokyo had flagged the exploited vulnerability pre-launch and that BetterBank's decision not to patch it was the proximate cause of the loss.","source":""}],"sources_used":[{"url":"https://rekt.news/betterbank-rekt","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260415155700/https://rekt.news/betterbank-rekt","credibility":3,"archive_timestamp":"2026-04-15T15:57:00+00:00"},{"url":"https://betterbanks-organization.gitbook.io/better-bank","name":"betterbanks-organization.gitbook.io","type":"other","archive_url":"http://web.archive.org/web/20250913155225/https://betterbanks-organization.gitbook.io/better-bank/","credibility":3,"archive_timestamp":"2025-09-13T15:52:25+00:00"},{"url":"https://defillama.com/protocol/betterbank","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250906134246/https://defillama.com/protocol/betterbank","credibility":3,"archive_timestamp":"2025-09-06T13:42:46+00:00"},{"url":"https://dappradar.com/dapp/betterbank/about","name":"dappradar.com","type":"other","archive_url":"https://web.archive.org/web/20260829031309/https://dappradar.com/about","credibility":3,"archive_timestamp":"2026-08-29T03:13:09+00:00"},{"url":"https://securelist.com/betterbank-defi-protocol-esteem-token-bonus-minting/117822/","name":"securelist.com","type":"other","archive_url":"http://web.archive.org/web/20260823172919/https://securelist.com/betterbank-defi-protocol-esteem-token-bonus-minting/117822/","credibility":3,"archive_timestamp":"2026-08-23T17:29:19+00:00"},{"url":"https://www.web3isgoinggreat.com/single/betterbank-exploit","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20251015021717/https://www.web3isgoinggreat.com/single/betterbank-exploit","credibility":3,"archive_timestamp":"2025-10-15T02:17:17+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-betterbank-hack-august-2025","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260517001334/https://www.halborn.com/blog/post/explained-the-betterbank-hack-august-2025","credibility":3,"archive_timestamp":"2026-05-17T00:13:34+00:00"},{"url":"https://olympixai.medium.com/post-mortem-betterbank-5m-exploit-august-2025-1e8657209842","name":"olympixai.medium.com","type":"other","archive_url":"http://web.archive.org/web/20251103212415/https://olympixai.medium.com/post-mortem-betterbank-5m-exploit-august-2025-1e8657209842","credibility":3,"archive_timestamp":"2025-11-03T21:24:15+00:00"},{"url":"https://www.quillaudits.com/blog/hack-analysis/betterbank-exploit","name":"quillaudits.com","type":"other","archive_url":"http://web.archive.org/web/20260417053244/https://www.quillaudits.com/blog/hack-analysis/betterbank-exploit","credibility":3,"archive_timestamp":"2026-04-17T05:32:44+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:16.271631+00:00","updated_at":"2026-08-29T09:21:01.360617+00:00"}}