Summary
BetterBank is a DeFi lending and borrowing protocol built on PulseChain, launched in August 2025, offering a dual-token system (ESTEEM and FAVOR) with high-yield savings and LP-backed credit. Approximately three weeks after launch, the protocol suffered a $5 million exploit on August 26-27, 2025, caused by an unvalidated bonus reward minting function that had been flagged as a critical vulnerability by auditor Zokyo one month prior but was downgraded to 'Informational' severity and left unpatched by the team. The attacker returned approximately $2.7 million following on-chain negotiations, leaving a net loss of roughly $1.4 million; the protocol subsequently froze trading and announced relaunch plans.
Connected Entities
1 entitiesTimeline(7 events)
2025-07-01
BetterBank launches on PulseChain offering high-yield savings and LP-backed credit via the ESTEEM and FAVOR dual-token system.
2025-07-01
Zokyo security audit conducted approximately one month before the exploit. Audit identifies critical vulnerability: 'A Malicious User Can Trade Bogus Tokens To Qualify For Bonus Favor Through The UniswapWrapper.' BetterBank team downgrades severity to Informational and does not implement the provided patch.
2025-08-26
Exploit begins. Attacker (primary address 0x48c9f537f3f1a2c95c46891332E05dA0D268869B, funded via Tornado Cash) deploys three custom contracts, creates fraudulent liquidity pools, and begins draining BetterBank's FAVOR and ESTEEM reward system via unauthorized bonus minting.
2025-08-27
Exploit concludes. Approximately $5 million in user funds drained: 891 million DAI, 9.05 billion PLSX, 7.40 billion WPLS. BetterBank freezes all FAVOR pools. On-chain negotiations with the attacker begin.
2025-08-27
Attacker returns 550 million pDAI (approximately $2.7 million) to the protocol. Net loss confirmed at approximately $1.4 million. Approximately 309 ETH moved toward Tornado Cash by attacker.
2025-08-27
BetterBank announces post-exploit recovery plan: contract patches, relaunch of ESTEEM and FAVOR with airdrops to legitimate holders, debt forgiveness using treasury reserves. 20% bounty announced for attacker identification.
2025-08-28
Multiple security firms (Halborn, QuillAudits, Olympix, Securelist, Rekt News) publish post-mortem analyses concluding that Zokyo had flagged the exploited vulnerability pre-launch and that BetterBank's decision not to patch it was the proximate cause of the loss.
Decision Log
- hash: 6YsHAREsCa2pDCUgocL149LbtEnekitfBXjdvDAgHffh
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:16 AM
last updated: 5/26/2026, 6:30:24 PM
avoid.net — verified advice for a post-truth world