{"investigation":{"slug":"evoq-finance","entity_name":"Evoq Finance","trust_score":38,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Evoq Finance is a peer-to-peer lending optimizer built on BNB Chain that routes deposits through Venus Protocol to match suppliers and borrowers directly, aiming for improved capital efficiency. On September 10, 2025, the protocol suffered a critical security incident in which an attacker compromised the owner's private key, used the transferOwnership function to seize contract control, and upgraded the proxy contract to a malicious version, draining approximately $420,000 from both the protocol and user-approved accounts. Following the exploit, the protocol's total value locked collapsed to near zero and no verified public post-mortem or recovery plan has been identified. ZachXBT has flagged this entity.","sections":[{"content":"Evoq Finance describes itself as a peer-to-peer (P2P) lending optimizer that layers atop established pool-based lending protocols, initially Venus Protocol on BNB Chain. The mechanism involves routing deposited funds into the underlying pool while the protocol's matching engine attempts to pair suppliers directly with borrowers. When a match occurs, the utilization rate effectively reaches 100%, which the protocol claims improves APY for both parties compared to base lending pool rates. The design is explicitly inspired by Morpho Optimizer on Ethereum, with Evoq's team acknowledging that significant portions of the security-critical code are adapted from Morpho's Compound optimizer. The protocol operates as an upgradeable proxy contract, which introduces centralization risk that proved consequential in the September 2025 incident. Evoq was selected for the Binance Most Valuable Builder (MVB) Season 8 accelerator cohort in October 2024, described therein as a 'pool-based P2P lending protocol that leverages Venus protocol on BSC.' The protocol also received recognition through Google Cloud's Web3 Startup Program.","heading":"Protocol Overview","sources":[{"url":"https://docs.evoq.finance","name":"docs.evoq.finance","type":"other","credibility":3},{"url":"https://docs.evoq.finance/protocol-overview/how-it-works","name":"docs.evoq.finance","type":"other","credibility":3},{"url":"https://cryptoslate.com/press-releases/meet-the-most-valuable-builder-mvb-season-8-cohort/","name":"cryptoslate.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/evoq-finance","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On September 10, 2025, Evoq Finance's smart contract on BNB Chain was exploited, resulting in a loss of approximately $420,000. The incident was first publicly reported by GoPlus Security. According to the GoPlus alert, the attacker obtained the private key of the protocol's owner account (abbreviated 0xF08d1c), then called the transferOwnership function to reassign administrative control to an attacker-controlled address (abbreviated 0x7b416F). With ownership transferred, the attacker executed a malicious upgrade of the upgradeable proxy contract (contract address 0xF9C74A65B04C73B911879DB0131616C556A626bE), replacing the legitimate implementation with code that drained funds held in the contract as well as funds from user accounts that had granted token approvals to the protocol. The attack vector was a compromised externally owned account (EOA) holding unilateral admin power over the proxy, rather than a multisignature wallet or timelock. This meant that once the private key was obtained, the attacker faced no additional technical barriers to a full protocol takeover. Following the exploit, GoPlus Security and multiple outlets urged affected users to immediately revoke token approvals for the affected contract. Security recommendations issued post-incident included implementing multisignature controls for high-privilege accounts and establishing regular key rotation protocols — mitigations that were not in place at the time of the attack. No verified official post-mortem from the Evoq Finance team has been identified in available sources.","heading":"Security Incident: $420,000 Private Key Compromise (September 2025)","sources":[{"url":"https://www.panewslab.com/en/articles/fdd02dfb-fadb-4c6f-ad87-f949fc5e21b5","name":"panewslab.com","type":"other","credibility":3},{"url":"https://www.chaincatcher.com/en/article/2204770","name":"chaincatcher.com","type":"other","credibility":3},{"url":"https://phemex.com/news/article/evoq-finance-loses-420000-in-smart-contract-attack-on-bnb-chain-18037","name":"phemex.com","type":"other","credibility":3},{"url":"https://www.mexc.com/news/evoq-finance-contract-attacked-losing-approximately-420000/92071","name":"mexc.com","type":"other","credibility":3},{"url":"https://x.com/GoPlusSecurity/status/1965805930504974515","name":"x.com","type":"other","credibility":3},{"url":"https://www.binance.com/en/square/post/09-10-2025-evoq-finance-suffers-420-000-loss-in-bnb-chain-smart-contract-attack-29506058045666","name":"binance.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The September 2025 exploit exposed a fundamental architectural risk: Evoq Finance's upgradeable proxy contract was controlled by a single externally owned account rather than a multisignature wallet or timelock mechanism. In upgradeable proxy architectures, the entity that controls the ProxyAdmin or owner variable has the ability to replace the underlying implementation contract with arbitrary code at any time, effectively granting them full authority over all user funds deposited in the protocol. Evoq's use of a single EOA for this role meant that theft of one private key was sufficient to drain the entire protocol. This stands in contrast to security best practices widely documented in the DeFi ecosystem, which recommend at minimum a multisignature wallet (e.g., Gnosis Safe with multiple signers) and ideally a timelock that gives users advance notice of pending upgrades. The protocol's 2025 roadmap, published earlier in the year, referenced a planned Q2 2025 public security audit and a Q3 2025 token generation event with decentralized governance, suggesting the transition to more decentralized control was anticipated but had not been implemented before the incident. No public disclosure has been identified confirming whether the planned governance decentralization was subsequently implemented.","heading":"Centralization and Governance Risk","sources":[{"url":"https://www.chaincatcher.com/en/article/2204770","name":"chaincatcher.com","type":"other","credibility":3},{"url":"https://medium.com/@bludesocial/evoqs-2025-roadmap-stewarding-capital-efficiency-d293a1e4c4e3","name":"medium.com","type":"other","credibility":3},{"url":"https://certik.com/resources/blog/upgradeable-proxy-contract-security-best-practices","name":"certik.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Evoq Finance's documentation lists two security audits completed prior to the September 2025 exploit. HashDit conducted an audit with a report dated December 12, 2024. Zokyo conducted a separate audit with a report dated January 9, 2025. Neither audit report is directly hosted on the Evoq Finance documentation site; they are linked via external storage (Google Drive for the HashDit report, the Zokyo audit reports GitHub repository for the Zokyo report). The content and specific findings of these audits have not been independently verified in this investigation. The protocol's documentation acknowledged smart contract risk, oracle risk, and liquidation risk as general categories of risk. The protocol also maintained a risk fund sourced from protocol reserves intended to cover unexpected losses; however, the size and capitalization of this fund at the time of the exploit are not publicly disclosed. The security architecture's reliance on an unprotected single-key owner account was not flagged as a critical finding in any publicly available pre-exploit discussion, though the attack method itself — compromising a single EOA holding admin keys — is a well-documented attack vector in DeFi security literature.","heading":"Audits and Pre-Incident Security Posture","sources":[{"url":"https://docs.evoq.finance/security/audits","name":"docs.evoq.finance","type":"other","credibility":3},{"url":"https://docs.evoq.finance/security/general-risks","name":"docs.evoq.finance","type":"other","credibility":3},{"url":"https://docs.evoq.finance/protocol-overview/risk-fund","name":"docs.evoq.finance","type":"other","credibility":3}],"severity":"medium"},{"content":"Prior to the September 2025 exploit, Evoq Finance was operating on BNB Chain with funds deployed through Venus Protocol. The protocol had achieved recognition through the Binance MVB Season 8 accelerator program (October 2024) and the Google Cloud Web3 Startup Program, and had published an ambitious 2025 roadmap including an official mainnet launch, tokenomics announcement, and token generation event. Following the September 10, 2025 exploit, DefiLlama data indicates the protocol's total value locked collapsed to approximately $267.68, effectively rendering the protocol non-operational for end users. Active loans fell to $0. The protocol's X (Twitter) account (@Evoq_Finance) remains active as of the time of this investigation, but no verified public post-mortem, compensation announcement, or relaunch plan has been identified through available sources. The protocol does not appear to have launched a governance token prior to the exploit, and no information on user compensation or fund recovery has been verified.","heading":"Protocol Status and TVL Impact","sources":[{"url":"https://defillama.com/protocol/evoq-finance","name":"defillama.com","type":"other","credibility":3},{"url":"https://cryptoslate.com/press-releases/meet-the-most-valuable-builder-mvb-season-8-cohort/","name":"cryptoslate.com","type":"other","credibility":3},{"url":"https://medium.com/@bludesocial/evoqs-2025-roadmap-stewarding-capital-efficiency-d293a1e4c4e3","name":"medium.com","type":"other","credibility":3},{"url":"https://x.com/Evoq_Finance","name":"x.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Evoq Finance's team has not been publicly identified in any verified source reviewed for this investigation. The protocol operates without named founders or team members in its public-facing documentation, website, or social media. The GitHub organization (github.com/evoqfinance) hosts the protocol's smart contract repository, which is open source and publicly available. The 2025 roadmap blog post was published under the handle 'Hayes' on Medium, attributed to a 'Content & Art' role, without further identifying information. LinkedIn lists a company page for Evoq Finance but does not reveal named employees or executives. The anonymous team structure, while common in DeFi, contributed to the opacity around the September 2025 incident response, as no identified individuals have issued public statements taking responsibility for the security failure or outlining steps taken to protect affected users. The protocol's participation in the Binance MVB Season 8 program implies some degree of vetting by Binance Labs and BNB Chain, though MVB acceptance does not constitute an investment decision or security endorsement.","heading":"Team and Transparency","sources":[{"url":"https://github.com/evoqfinance/evoq-finance-contracts","name":"github.com","type":"other","credibility":3},{"url":"https://medium.com/@bludesocial/evoqs-2025-roadmap-stewarding-capital-efficiency-d293a1e4c4e3","name":"medium.com","type":"other","credibility":3},{"url":"https://www.linkedin.com/company/evoq-finance","name":"linkedin.com","type":"other","credibility":3},{"url":"https://cryptoslate.com/press-releases/meet-the-most-valuable-builder-mvb-season-8-cohort/","name":"cryptoslate.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2024-10-28","event":"Evoq Finance selected for Binance Most Valuable Builder (MVB) Season 8 accelerator program, described as a 'pool-based P2P lending protocol that leverages Venus protocol on BSC.' Program kicked off in Dubai.","source":""},{"date":"2024-12-12","event":"HashDit completes a security audit of Evoq Finance's smart contracts.","source":""},{"date":"2025-01-09","event":"Zokyo completes a second security audit of Evoq Finance's smart contracts.","source":""},{"date":"2025","event":"Evoq Finance publishes its 2025 roadmap targeting Q1 mainnet open beta, Q2 public audit, Q3 token generation event, and Q4 multi-protocol expansion.","source":"","date_original":"2025-01-01"},{"date":"2025-09-10","event":"Evoq Finance smart contract on BNB Chain exploited. Attacker compromises the owner private key (EOA 0xF08d1c), transfers contract ownership to attacker address 0x7b416F, upgrades proxy to malicious implementation, and drains approximately $420,000 from the protocol and user-approved accounts. GoPlus Security issues a public alert.","source":""},{"date":"2025-09-10","event":"GoPlus Security and multiple crypto news outlets urge users to revoke token approvals for contract 0xF9C74A65B04C73B911879DB0131616C556A626bE. Post-incident security recommendations include multisignature controls and key rotation.","source":""},{"date":"2025-09-10","event":"Evoq Finance TVL collapses to near zero following the exploit. Active loans fall to $0 on DefiLlama.","source":""}],"sources_used":[{"url":"https://docs.evoq.finance","name":"docs.evoq.finance","type":"other","archive_url":"http://web.archive.org/web/20260313101757/https://docs.evoq.finance/","credibility":3,"archive_timestamp":"2026-03-13T10:17:57+00:00"},{"url":"https://docs.evoq.finance/protocol-overview/how-it-works","name":"docs.evoq.finance","type":"other","archive_url":"http://web.archive.org/web/20260516232519/https://docs.evoq.finance/protocol-overview/how-it-works","credibility":3,"archive_timestamp":"2026-05-16T23:25:19+00:00"},{"url":"https://cryptoslate.com/press-releases/meet-the-most-valuable-builder-mvb-season-8-cohort/","name":"cryptoslate.com","type":"other","archive_url":"http://web.archive.org/web/20260116224100/https://cryptoslate.com/press-releases/meet-the-most-valuable-builder-mvb-season-8-cohort/","credibility":3,"archive_timestamp":"2026-01-16T22:41:00+00:00"},{"url":"https://defillama.com/protocol/evoq-finance","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250914001859/https://defillama.com/protocol/evoq-finance","credibility":3,"archive_timestamp":"2025-09-14T00:18:59+00:00"},{"url":"https://www.panewslab.com/en/articles/fdd02dfb-fadb-4c6f-ad87-f949fc5e21b5","name":"panewslab.com","type":"other","archive_url":"http://web.archive.org/web/20251106021409/https://www.panewslab.com/en/articles/fdd02dfb-fadb-4c6f-ad87-f949fc5e21b5","credibility":3,"archive_timestamp":"2025-11-06T02:14:09+00:00"},{"url":"https://www.chaincatcher.com/en/article/2204770","name":"chaincatcher.com","type":"other","archive_url":"https://web.archive.org/web/20260829084421/https://www.chaincatcher.com/en/article/2204770","credibility":3,"archive_timestamp":"2026-08-29T08:44:21+00:00"},{"url":"https://phemex.com/news/article/evoq-finance-loses-420000-in-smart-contract-attack-on-bnb-chain-18037","name":"phemex.com","type":"other","archive_url":"http://web.archive.org/web/20260829040331/https://phemex.com/news/article/evoq-finance-loses-420000-in-smart-contract-attack-on-bnb-chain-18037","credibility":3,"archive_timestamp":"2026-08-29T04:03:31+00:00"},{"url":"https://www.mexc.com/news/evoq-finance-contract-attacked-losing-approximately-420000/92071","name":"mexc.com","type":"other","archive_url":"http://web.archive.org/web/20250919214452/https://www.mexc.com/news/evoq-finance-contract-attacked-losing-approximately-420000/92071","credibility":3,"archive_timestamp":"2025-09-19T21:44:52+00:00"},{"url":"https://x.com/GoPlusSecurity/status/1965805930504974515","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.binance.com/en/square/post/09-10-2025-evoq-finance-suffers-420-000-loss-in-bnb-chain-smart-contract-attack-29506058045666","name":"binance.com","type":"other","archive_url":"https://web.archive.org/web/20260829083305/https://www.binance.com/en/square/post/09-10-2025-evoq-finance-suffers-420-000-loss-in-bnb-chain-smart-contract-attack-29506058045666","credibility":3,"archive_timestamp":"2026-08-29T08:33:05+00:00"},{"url":"https://medium.com/@bludesocial/evoqs-2025-roadmap-stewarding-capital-efficiency-d293a1e4c4e3","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://certik.com/resources/blog/upgradeable-proxy-contract-security-best-practices","name":"certik.com","type":"other","archive_url":"https://web.archive.org/web/20260829025219/https://www.certik.com/blog/upgradeable-proxy-contract-security-best-practices","credibility":3,"archive_timestamp":"2026-08-29T02:52:19+00:00"},{"url":"https://docs.evoq.finance/security/audits","name":"docs.evoq.finance","type":"other","archive_url":"http://web.archive.org/web/20260420115426/https://docs.evoq.finance/security/audits","credibility":3,"archive_timestamp":"2026-04-20T11:54:26+00:00"},{"url":"https://docs.evoq.finance/security/general-risks","name":"docs.evoq.finance","type":"other","archive_url":"http://web.archive.org/web/20260313111429/https://docs.evoq.finance/security/general-risks","credibility":3,"archive_timestamp":"2026-03-13T11:14:29+00:00"},{"url":"https://docs.evoq.finance/protocol-overview/risk-fund","name":"docs.evoq.finance","type":"other","archive_url":"http://web.archive.org/web/20260517001518/https://docs.evoq.finance/protocol-overview/risk-fund","credibility":3,"archive_timestamp":"2026-05-17T00:15:18+00:00"},{"url":"https://x.com/Evoq_Finance","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://github.com/evoqfinance/evoq-finance-contracts","name":"github.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.linkedin.com/company/evoq-finance","name":"linkedin.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:15.85267+00:00","updated_at":"2026-08-30T15:55:36.644522+00:00"}}