{"investigation":{"slug":"palmswap","entity_name":"Palmswap","trust_score":22,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Palmswap was a decentralized perpetual futures exchange built on BNB Chain (Binance Smart Chain), launched in 2022 and offering up to 50x leverage trading via its PALM governance token and PLP liquidity provider token. On July 24–25, 2023, the protocol suffered a flash loan price manipulation exploit that drained approximately $901,455 USDT from its liquidity vault due to a critical smart contract logic flaw in the PlpManager contract. The exploiter ultimately returned $721,450 of the stolen funds after bounty negotiations, but the protocol's liquidity partner Gotbit was subsequently indicted and convicted by US federal prosecutors for market manipulation and wire fraud, raising additional integrity concerns about the project's ecosystem.","sections":[{"content":"Palmswap was a BNB Smart Chain-based decentralized perpetual exchange that aimed to replicate the experience of centralized derivatives platforms without requiring user registration or KYC. The protocol offered up to 50x leverage on perpetual futures contracts and was structured around two core tokens: PALM, a BEP-20 governance token, and PLP (Palm Liquidity Provider), a staking token representing user deposits in the liquidity vault. The project held a community fair launch on September 20, 2022, raising over 6,600 BNB. Co-founder Bernd Stöckl, a Dubai-based Austrian entrepreneur, served as Chief Product Officer and was the primary public-facing representative of the team, while other founding members remained anonymous. Palmswap received seed investment from Crypto Oasis and partnered with Gotbit Hedge Fund as its market maker and liquidity provider ahead of its V2 launch in June 2023. By 2024, the project had become inactive with its website offline and effectively zero trading volume or TVL, and it is now considered defunct.","heading":"Protocol Overview","sources":[{"url":"https://bitcoinist.com/a-cex-like-dex-palmswap-v1-launches-perpetual-exchange-on-bnb-chain/","name":"Palmswap V1 launches on BNB Chain — Bitcoinist","type":"news_article","credibility":2},{"url":"https://cryptonews.net/news/market/13677795/","name":"Palmswap fair launch raises over 6,600 BNB — CryptoNews","type":"news_article","credibility":2},{"url":"https://medium.com/@omemmaan/bernd-st%C3%B6ckl-is-the-cpo-and-co-founder-of-palmswap-a-decentralized-perpetual-contract-trading-1f7c728ecab0","name":"Bernd Stöckl CPO and Co-Founder profile — Medium","type":"other","credibility":3},{"url":"https://dappradar.com/dapp/palmswap/","name":"Palmswap DApp status — DappRadar","type":"research","credibility":2}],"severity":"medium"},{"content":"On July 24–25, 2023, an attacker exploited a critical price calculation flaw in Palmswap's PlpManager smart contract, draining approximately 901,455 USDT from the protocol's liquidity vault. The root cause was an incorrect exchange rate calculation between the USDP stablecoin and PLP liquidity tokens: when adding liquidity the conversion rate was applied at 1:1, but when removing liquidity the rate reflected an inflated value of approximately 1.9:1, creating an exploitable arbitrage. The attacker obtained a flash loan of 3,000,000 USDT, used 1,000,000 USDT to mint PLP tokens via the purchasePlp() function, then transferred the remaining 2,000,000 USDT directly to the vault contract through the buyUSDP() function — a call that lacked proper access controls — artificially inflating the vault's USDT reserves without increasing PLP supply. The attacker then redeemed PLP tokens at the manipulated higher price, sold all resulting USDP, repaid the flash loan, and retained approximately $901,455 in profit. CertiK identified this attack as the second-largest malicious flash loan incident it tracked during July 2023, a month in which flash loan attacks totaled $5.8 million across DeFi. Multiple blockchain security firms — including SlowMist, CertiK, QuillAudits, and Olympix — independently analyzed and confirmed the attack mechanics. The key attacker EOA address is 0xf84efa8a9f7e68855cf17eaac9c2f97a9d131366 and the attack contract is 0x55252a6d50bfad0e5f1009541284c783686f7f25; the primary attack transaction hash is 0x62dba55054fa628845fecded658ff5b1ec1c5823f1a5e0118601aa455a30eac9 on BSCScan.","heading":"July 2023 Flash Loan Exploit","sources":[{"url":"https://slowmist.medium.com/analysis-of-palmswap-incident-c6b5e3eb2815","name":"Analysis of Palmswap incident — SlowMist via Medium","type":"research","credibility":2},{"url":"https://www.certik.com/resources/blog/6WoTgIL26yP5NZyStcQZps-palmswap-incident-analysis","name":"Palmswap Incident Analysis — CertiK","type":"research","credibility":2},{"url":"https://www.quillaudits.com/blog/hack-analysis/palmswap-900k-exploit","name":"Decoding Palmswap's $900k Exploit — QuillAudits","type":"research","credibility":2},{"url":"https://olympix.security/blog/900k-price-manipulation-attack-on-palmswap","name":"$900K Price Manipulation Attack on Palmswap — Olympix","type":"research","credibility":2},{"url":"https://bscscan.com/tx/0x62dba55054fa628845fecded658ff5b1ec1c5823f1a5e0118601aa455a30eac9","name":"Attack transaction — BSCScan","type":"on_chain","credibility":1}],"severity":"critical"},{"content":"Following the exploit, the Palmswap team publicly acknowledged the incident and reached out to the attacker's wallet address to negotiate a bounty arrangement. The negotiations were ultimately partially successful: the exploiter returned $721,450 of the approximately $901,455 stolen, representing roughly 80% of the drained funds, and was subsequently characterized by some reporting as having acted in a white-hat capacity. The remaining approximately $179,500 was not returned. As of November 2023, the Palmswap team's own community update stated that a full refund to affected liquidity providers was still pending, was entangled in a 'lengthy legal process,' and that refunds would 'most probably be in USDT' once sufficient funds were raised — though 'nothing final has been determined.' The team also offered affected users the option of accepting PALM tokens instead of USDT compensation, an arrangement that would transfer recovery risk to token holders given PALM's declining value. No public post-mortem report with technical remediation steps was published by the Palmswap team, and no independent verification of the compensation distribution to individual liquidity providers has been documented.","heading":"Fund Recovery and Bounty Negotiations","sources":[{"url":"https://www.binance.com/en/square/post/867128","name":"Palmswap Exploiter Returns $721,450 of Stolen Funds — Binance Square","type":"news_article","credibility":2},{"url":"https://palmswap.medium.com/v2-community-update-ama-thursday-november-19th-recap-0f98fc23e0f2","name":"Palmswap V2 Community Update AMA November 2023 — Medium","type":"official","credibility":2},{"url":"https://www.certik.com/resources/blog/6WoTgIL26yP5NZyStcQZps-palmswap-incident-analysis","name":"Palmswap Incident Analysis — CertiK","type":"research","credibility":2}],"severity":"high"},{"content":"Prior to the July 2023 exploit, Palmswap's smart contracts underwent a security audit by Zokyo Security, which awarded the protocol a score of 98% and concluded that the code met security qualifications for listing on digital asset exchanges. The audit noted that 100% of the code was testable, exceeding the standard 95% threshold. However, this audit failed to identify the critical price calculation flaw in the PlpManager contract that enabled the $901,455 flash loan exploit — a defect classified as a 'Protocol Logic' vulnerability by CertiK. This outcome illustrates a widely recognized limitation of pre-deployment smart contract audits, which assess code against known patterns at a point in time but do not guarantee protection against all attack vectors, particularly those arising from economic logic flaws and price manipulation. The exploit occurred just weeks after Gotbit's liquidity deployment on the protocol in late June 2023, at a time when Palmswap's liquidity pool had been seeded with significant capital to support the V2 launch.","heading":"Pre-Exploit Audit Failure","sources":[{"url":"https://crypto981.wordpress.com/2023/07/08/palmswap-part-1-token-audit/","name":"PALMSWAP – Part 1 – Token Audit — Independent Blog","type":"research","credibility":3},{"url":"https://www.certik.com/resources/blog/6WoTgIL26yP5NZyStcQZps-palmswap-incident-analysis","name":"Palmswap Incident Analysis — CertiK","type":"research","credibility":2},{"url":"https://www.quillaudits.com/blog/hack-analysis/palmswap-900k-exploit","name":"Decoding Palmswap's $900k Exploit — QuillAudits","type":"research","credibility":2}],"severity":"high"},{"content":"In June 2023, approximately one month before the exploit, Palmswap publicly announced a partnership with Gotbit Hedge Fund, a self-described market maker, to provide liquidity for its V2 launch event beginning June 27, 2023. Gotbit's role involved minting and auto-staking PLP tokens as part of the Palmswap Liquidity Provider program. In October 2024, the US Department of Justice and the Securities and Exchange Commission brought criminal and civil charges against Gotbit Consulting LLC and its founder Aleksei Andriunin for market manipulation and wire fraud conspiracy. The government alleged that Gotbit operated a 'market-manipulation-as-a-service' business, using algorithmic wash trading to generate artificial trading volume for client cryptocurrency projects. Andriunin subsequently pleaded guilty to wire fraud and conspiracy to commit market manipulation and was sentenced to eight months in prison in 2025, with the company agreeing to forfeit $23 million. The SEC's parallel civil complaint named Gotbit employee Fedor Kedrov. No public evidence has established that Gotbit manipulated PALM token markets specifically on behalf of Palmswap, but the publicly documented partnership between the two entities — combined with Gotbit's convicted criminal business model — represents a material integrity concern for the project's market history. The connection is noted as an associated risk rather than a proven direct wrongdoing by Palmswap.","heading":"Gotbit Partnership and Subsequent Criminal Conviction","sources":[{"url":"https://cointelegraph.com/press-releases/palmswap-secures-partnership-with-gotbit-for-the-palmswap-liquidity-event","name":"Palmswap secures partnership with Gotbit for the Palmswap liquidity event — CoinTelegraph Press Release","type":"news_article","credibility":2},{"url":"https://www.sec.gov/newsroom/press-releases/2024-166","name":"SEC Charges Three So-Called Market Makers — SEC.gov","type":"regulatory","credibility":1},{"url":"https://www.justice.gov/usao-ma/pr/cryptocurrency-financial-services-firm-gotbit-and-founder-sentenced-market-manipulation","name":"Gotbit and Founder Sentenced for Market Manipulation — DOJ","type":"court_filing","credibility":1},{"url":"https://www.justice.gov/usao-ma/pr/cryptocurrency-financial-services-firm-gotbit-and-founder-plead-guilty-market","name":"Gotbit and Founder Plead Guilty — DOJ","type":"court_filing","credibility":1},{"url":"https://www.coinspeaker.com/palmswap-gotbit-liquidity-event/","name":"Palmswap joins forces with Gotbit ahead of liquidity event — Coinspeaker","type":"news_article","credibility":2}],"severity":"high"},{"content":"Following the July 2023 exploit, Palmswap's PALM token — which had reached an all-time high of approximately $0.1505 on October 25, 2022, during the project's initial launch phase — declined sharply and now trades at effectively zero with no measurable daily volume. DappRadar listed the protocol as inactive after detecting no on-chain activity for at least 30 days, and the Palmswap website is no longer accessible. The team's November 2023 community update outlined a roadmap with planned features for Q1 2024, including fiat on-ramps, multi-chain deposits, and copy-trading, but none of these appear to have launched. The project's total value locked also collapsed to near zero. While the team maintained a public posture of continued development through late 2023, no meaningful protocol activity has been documented since. As of mid-2026, Palmswap is effectively defunct with its protocol contracts dormant, no active liquidity, and no communications from the team. Affected liquidity providers who did not receive compensation from the partial fund return have no known active recourse.","heading":"Project Collapse and Current Status","sources":[{"url":"https://coinmarketcap.com/currencies/palmswap/","name":"Palmswap price today — CoinMarketCap","type":"research","credibility":2},{"url":"https://dappradar.com/dapp/palmswap/","name":"Palmswap DApp status — DappRadar","type":"research","credibility":2},{"url":"https://palmswap.medium.com/v2-community-update-ama-thursday-november-19th-recap-0f98fc23e0f2","name":"Palmswap V2 Community Update AMA November 2023 — Medium","type":"official","credibility":2}],"severity":"high"},{"content":"On-chain investigator ZachXBT flagged Palmswap as part of his monitoring of DeFi exploits and suspicious protocols. ZachXBT is a pseudonymous blockchain forensics researcher known for tracing stolen funds and identifying bad actors across DeFi, and the AVOID.NET platform includes Palmswap in its index based on his signal. While a specific published ZachXBT thread or Mirror.xyz article dedicated solely to Palmswap was not independently verifiable through open web search as of this investigation's writing, the exploit event itself was widely covered by credible security firms and news outlets, and the project's association with the subsequently convicted market maker Gotbit adds to the basis for elevated scrutiny. Users seeking ZachXBT's precise commentary should consult his public X profile at x.com/zachxbt and Mirror.xyz archive directly. The flag is treated as a Tier 3 signal for sourcing purposes given the absence of a directly verifiable published thread, though the underlying facts — the exploit, the Gotbit connection, and the project's abandonment — are corroborated by Tier 1 and Tier 2 sources independently.","heading":"ZachXBT Flag","sources":[{"url":"https://x.com/zachxbt","name":"ZachXBT on X","type":"social_media","credibility":3},{"url":"https://zachxbt.mirror.xyz/","name":"ZachXBT Mirror.xyz archive","type":"social_media","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2022-09-20","event":"Palmswap holds community fair launch, raising over 6,600 BNB from participants.","source":"CryptoNews","source_url":"https://cryptonews.net/news/market/13677795/"},{"date":"2022-10-25","event":"PALM token reaches its all-time high price of approximately $0.1505.","source":"CoinMarketCap","source_url":"https://coinmarketcap.com/currencies/palmswap/"},{"date":"2023-06-27","event":"Palmswap publicly announces partnership with Gotbit Hedge Fund to provide liquidity for V2 launch. Gotbit mints and auto-stakes PLP tokens as part of the launch event.","source":"CoinTelegraph Press Release","source_url":"https://cointelegraph.com/press-releases/palmswap-secures-partnership-with-gotbit-for-the-palmswap-liquidity-event"},{"date":"2023-07-24","event":"Flash loan exploit begins. Attacker uses 3,000,000 USDT flash loan to exploit a price calculation flaw in the PlpManager contract, draining approximately 901,455 USDT from Palmswap's liquidity vault.","source":"CertiK Incident Analysis","source_url":"https://www.certik.com/resources/blog/6WoTgIL26yP5NZyStcQZps-palmswap-incident-analysis"},{"date":"2023-07-25","event":"SlowMist publishes independent on-chain analysis confirming the exploit mechanics and total loss of over $900,000.","source":"SlowMist via Medium","source_url":"https://slowmist.medium.com/analysis-of-palmswap-incident-c6b5e3eb2815"},{"date":"2023-07-25","event":"Palmswap team acknowledges the exploit publicly and initiates contact with the attacker's wallet address to negotiate a bounty.","source":"Binance Square","source_url":"https://www.binance.com/en/square/post/867128"},{"date":"2023-07-31","event":"Exploiter returns $721,450 to Palmswap following bounty negotiations, retaining approximately $179,505 as an alleged bounty. Roughly 20% of stolen funds are not recovered.","source":"Binance Square","source_url":"https://www.binance.com/en/square/post/867128"},{"date":"2023-11-19","event":"Palmswap holds V2 community update AMA. Team states that user refunds are pending a 'lengthy legal process' and that repayment in USDT is planned but 'nothing final has been determined.' Roadmap for Q1 2024 features announced.","source":"Palmswap via Medium","source_url":"https://palmswap.medium.com/v2-community-update-ama-thursday-november-19th-recap-0f98fc23e0f2"},{"date":"2024-10-09","event":"US DOJ and SEC announce charges against Gotbit Consulting LLC and its founder Aleksei Andriunin for market manipulation and wire fraud conspiracy. Gotbit had been Palmswap's liquidity partner.","source":"SEC Press Release","source_url":"https://www.sec.gov/newsroom/press-releases/2024-166"},{"date":"2025-03","event":"Gotbit founder Aleksei Andriunin pleads guilty to wire fraud and conspiracy to commit market manipulation in US federal court in Boston.","source":"DOJ District of Massachusetts","source_url":"https://www.justice.gov/usao-ma/pr/cryptocurrency-financial-services-firm-gotbit-and-founder-plead-guilty-market","date_original":"2025-03-01"},{"date":"2025-06","event":"Gotbit founder Aleksei Andriunin sentenced to eight months in prison and one year of supervised release; company agrees to forfeit $23 million.","source":"DOJ District of Massachusetts","source_url":"https://www.justice.gov/usao-ma/pr/cryptocurrency-financial-services-firm-gotbit-and-founder-sentenced-market-manipulation","date_original":"2025-06-01"},{"date":"2026-05","event":"Palmswap protocol is effectively defunct. Website offline, PALM token trades at approximately $0 with no volume, DappRadar lists the protocol as inactive, and no team communications have been issued.","source":"DappRadar","source_url":"https://dappradar.com/dapp/palmswap/","date_original":"2026-05-01"}],"sources_used":[{"url":"https://slowmist.medium.com/analysis-of-palmswap-incident-c6b5e3eb2815","name":"Analysis of Palmswap incident — SlowMist via Medium","type":"research","archive_url":"http://web.archive.org/web/20250909130423/https://slowmist.medium.com/analysis-of-palmswap-incident-c6b5e3eb2815","credibility":2,"archive_timestamp":"2025-09-09T13:04:23+00:00"},{"url":"https://www.certik.com/resources/blog/6WoTgIL26yP5NZyStcQZps-palmswap-incident-analysis","name":"Palmswap Incident Analysis — CertiK","type":"research","archive_url":"https://web.archive.org/web/20260724173107/https://www.certik.com/blog/6WoTgIL26yP5NZyStcQZps-palmswap-incident-analysis","credibility":2,"archive_timestamp":"2026-07-24T17:31:07+00:00"},{"url":"https://www.quillaudits.com/blog/hack-analysis/palmswap-900k-exploit","name":"Decoding Palmswap's $900k Exploit — QuillAudits","type":"research","archive_url":"http://web.archive.org/web/20260417052305/https://www.quillaudits.com/blog/hack-analysis/palmswap-900k-exploit","credibility":2,"archive_timestamp":"2026-04-17T05:23:05+00:00"},{"url":"https://olympix.security/blog/900k-price-manipulation-attack-on-palmswap","name":"$900K Price Manipulation Attack on Palmswap — Olympix Security","type":"research","archive_url":"http://web.archive.org/web/20260216054334/https://olympix.security/blog/900k-price-manipulation-attack-on-palmswap","credibility":2,"archive_timestamp":"2026-02-16T05:43:34+00:00"},{"url":"https://www.binance.com/en/square/post/867128","name":"Palmswap Exploiter Returns $721,450 of Stolen Funds — Binance Square","type":"news_article","archive_url":"https://web.archive.org/web/20260725034731/https://www.binance.com/en/square/post/867128","credibility":2,"archive_timestamp":"2026-07-25T03:47:31+00:00"},{"url":"https://palmswap.medium.com/v2-community-update-ama-thursday-november-19th-recap-0f98fc23e0f2","name":"Palmswap V2 Community Update AMA November 2023 — Medium","type":"official","archive_url":"https://web.archive.org/web/20260724210630/https://palmswap.medium.com/v2-community-update-ama-thursday-november-19th-recap-0f98fc23e0f2","credibility":2,"archive_timestamp":"2026-07-24T21:06:30+00:00"},{"url":"https://cointelegraph.com/press-releases/palmswap-secures-partnership-with-gotbit-for-the-palmswap-liquidity-event","name":"Palmswap secures partnership with Gotbit — CoinTelegraph","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.sec.gov/newsroom/press-releases/2024-166","name":"SEC Charges Three Crypto Market Makers including Gotbit — SEC.gov","type":"regulatory","archive_url":"http://web.archive.org/web/20260401095138/https://www.sec.gov/newsroom/press-releases/2024-166","credibility":1,"archive_timestamp":"2026-04-01T09:51:38+00:00"},{"url":"https://www.justice.gov/usao-ma/pr/cryptocurrency-financial-services-firm-gotbit-and-founder-plead-guilty-market","name":"Gotbit and Founder Plead Guilty — DOJ","type":"court_filing","archive_url":"http://web.archive.org/web/20260525023450/https://www.justice.gov/usao-ma/pr/cryptocurrency-financial-services-firm-gotbit-and-founder-plead-guilty-market","credibility":1,"archive_timestamp":"2026-05-25T02:34:50+00:00"},{"url":"https://www.justice.gov/usao-ma/pr/cryptocurrency-financial-services-firm-gotbit-and-founder-sentenced-market-manipulation","name":"Gotbit and Founder Sentenced — DOJ","type":"court_filing","archive_url":"http://web.archive.org/web/20260524033305/https://www.justice.gov/usao-ma/pr/cryptocurrency-financial-services-firm-gotbit-and-founder-sentenced-market-manipulation","credibility":1,"archive_timestamp":"2026-05-24T03:33:05+00:00"},{"url":"https://bitcoinist.com/a-cex-like-dex-palmswap-v1-launches-perpetual-exchange-on-bnb-chain/","name":"Palmswap V1 launches on BNB Chain — Bitcoinist","type":"news_article","archive_url":"https://web.archive.org/web/20260725033906/https://bitcoinist.com/a-cex-like-dex-palmswap-v1-launches-perpetual-exchange-on-bnb-chain/","credibility":2,"archive_timestamp":"2026-07-25T03:39:06+00:00"},{"url":"https://cryptonews.net/news/market/13677795/","name":"Palmswap fair launch raises over 6,600 BNB — CryptoNews","type":"news_article","archive_url":"http://web.archive.org/web/20260724163643/https://cryptonews.net/news/market/13677795/","credibility":2,"archive_timestamp":"2026-07-24T16:36:43+00:00"},{"url":"https://coinmarketcap.com/currencies/palmswap/","name":"Palmswap price and market data — CoinMarketCap","type":"research","archive_url":"http://web.archive.org/web/20250917210333/https://coinmarketcap.com/currencies/palmswap/","credibility":2,"archive_timestamp":"2025-09-17T21:03:33+00:00"},{"url":"https://dappradar.com/dapp/palmswap/","name":"Palmswap DApp status — DappRadar","type":"research","archive_url":"http://web.archive.org/web/20260724163742/https://dappradar.com/dapp/palmswap","credibility":2,"archive_timestamp":"2026-07-24T16:37:42+00:00"},{"url":"https://bscscan.com/tx/0x62dba55054fa628845fecded598ff5b1ec1c5823f1a5e0118601aa455a30eac9","name":"Attack transaction on BSCScan","type":"on_chain","archive_url":"http://web.archive.org/web/20260724171846/https://bscscan.com/tx/0x62dba55054fa628845fecded598ff5b1ec1c5823f1a5e0118601aa455a30eac9","credibility":1,"archive_timestamp":"2026-07-24T17:18:46+00:00"},{"url":"https://x.com/zachxbt","name":"ZachXBT on X","type":"social_media","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.coinspeaker.com/palmswap-gotbit-liquidity-event/","name":"Palmswap joins forces with Gotbit — Coinspeaker","type":"news_article","archive_url":"http://web.archive.org/web/20260311010646/https://www.coinspeaker.com/palmswap-gotbit-liquidity-event/","credibility":2,"archive_timestamp":"2026-03-11T01:06:46+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:40.178031+00:00","updated_at":"2026-08-29T01:32:54.178+00:00"}}