Audit log

Every state-changing event for BetterBank: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-26 18:30:24Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,338,841

   sig

   5pyTx7QAyKGm…Lu9uazARcopyexplorer ↗

   hash

   6YsHAREsCa2p…vDAgHffhcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6611 B) ▸

   {"actor":"system:backfill","investigation_id":"b80c6b22-2526-403a-880b-03d15b8f5bfa","kind":"publish","page_slug":"betterbank","published_at":"2026-05-26T18:30:24.625Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"BetterBank","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/betterbank-rekt","type":"other","url":""},{"credibility":3,"name":"https://betterbanks-organization.gitbook.io/better-bank","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/betterbank","type":"other","url":""},{"credibility":3,"name":"https://dappradar.com/dapp/betterbank/about","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/betterbank-rekt","type":"other","url":""},{"credibility":3,"name":"https://securelist.com/betterbank-defi-protocol-esteem-token-bonus-minting/117822/","type":"other","url":""},{"credibility":3,"name":"https://www.web3isgoinggreat.com/single/betterbank-exploit","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-betterbank-hack-august-2025","type":"other","url":""},{"credibility":3,"name":"https://olympixai.medium.com/post-mortem-betterbank-5m-exploit-august-2025-1e8657209842","type":"other","url":""},{"credibility":3,"name":"https://www.quillaudits.com/blog/hack-analysis/betterbank-exploit","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/betterbank-rekt","type":"other","url":""},{"credibility":3,"name":"https://securelist.com/betterbank-defi-protocol-esteem-token-bonus-minting/117822/","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-betterbank-hack-august-2025","type":"other","url":""},{"credibility":3,"name":"https://olympixai.medium.com/post-mortem-betterbank-5m-exploit-august-2025-1e8657209842","type":"other","url":""},{"credibility":3,"name":"https://www.quillaudits.com/blog/hack-analysis/betterbank-exploit","type":"other","url":""},{"credibility":3,"name":"https://www.web3isgoinggreat.com/single/betterbank-exploit","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/betterbank-rekt","type":"other","url":""},{"credibility":3,"name":"https://securelist.com/betterbank-defi-protocol-esteem-token-bonus-minting/117822/","type":"other","url":""},{"credibility":3,"name":"https://www.quillaudits.com/blog/hack-analysis/betterbank-exploit","type":"other","url":""},{"credibility":3,"name":"https://olympixai.medium.com/post-mortem-betterbank-5m-exploit-august-2025-1e8657209842","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/betterbank-rekt","type":"other","url":""},{"credibility":3,"name":"https://dappradar.com/dapp/betterbank/about","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/betterbank-rekt","type":"other","url":""},{"credibility":3,"name":"https://www.web3isgoinggreat.com/single/betterbank-exploit","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/betterbank-rekt","type":"other","url":""},{"credibility":3,"name":"https://securelist.com/betterbank-defi-protocol-esteem-token-bonus-minting/117822/","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-betterbank-hack-august-2025","type":"other","url":""},{"credibility":3,"name":"https://olympixai.medium.com/post-mortem-betterbank-5m-exploit-august-2025-1e8657209842","type":"other","url":""},{"credibility":3,"name":"https://www.quillaudits.com/blog/hack-analysis/betterbank-exploit","type":"other","url":""}]}],"sources_used":[],"summary":"BetterBank is a DeFi lending and borrowing protocol built on PulseChain, launched in August 2025, offering a dual-token system (ESTEEM and FAVOR) with high-yield savings and LP-backed credit. Approximately three weeks after launch, the protocol suffered a $5 million exploit on August 26-27, 2025, caused by an unvalidated bonus reward minting function that had been flagged as a critical vulnerability by auditor Zokyo one month prior but was downgraded to 'Informational' severity and left unpatched by the team. The attacker returned approximately $2.7 million following on-chain negotiations, leaving a net loss of roughly $1.4 million; the protocol subsequently froze trading and announced relaunch plans.","timeline":[{"date":"2025-07-01","event":"BetterBank launches on PulseChain offering high-yield savings and LP-backed credit via the ESTEEM and FAVOR dual-token system.","source":""},{"date":"2025-07-01","event":"Zokyo security audit conducted approximately one month before the exploit. Audit identifies critical vulnerability: 'A Malicious User Can Trade Bogus Tokens To Qualify For Bonus Favor Through The UniswapWrapper.' BetterBank team downgrades severity to Informational and does not implement the provided patch.","source":""},{"date":"2025-08-26","event":"Exploit begins. Attacker (primary address 0x48c9f537f3f1a2c95c46891332E05dA0D268869B, funded via Tornado Cash) deploys three custom contracts, creates fraudulent liquidity pools, and begins draining BetterBank's FAVOR and ESTEEM reward system via unauthorized bonus minting.","source":""},{"date":"2025-08-27","event":"Exploit concludes. Approximately $5 million in user funds drained: 891 million DAI, 9.05 billion PLSX, 7.40 billion WPLS. BetterBank freezes all FAVOR pools. On-chain negotiations with the attacker begin.","source":""},{"date":"2025-08-27","event":"Attacker returns 550 million pDAI (approximately $2.7 million) to the protocol. Net loss confirmed at approximately $1.4 million. Approximately 309 ETH moved toward Tornado Cash by attacker.","source":""},{"date":"2025-08-27","event":"BetterBank announces post-exploit recovery plan: contract patches, relaunch of ESTEEM and FAVOR with airdrops to legitimate holders, debt forgiveness using treasury reserves. 20% bounty announced for attacker identification.","source":""},{"date":"2025-08-28","event":"Multiple security firms (Halborn, QuillAudits, Olympix, Securelist, Rekt News) publish post-mortem analyses concluding that Zokyo had flagged the exploited vulnerability pre-launch and that BetterBank's decision not to patch it was the proximate cause of the loss.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 4d8962ce-aa3e-446e-abd2-f6691ebddaf6copy
2. #2rescoreby systemsystem

   2026-10-27 06:07:27Z
   Score: 28 → 47 (+19)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 47. Problems weighed by who is responsible: concerns that are not fraud −12.8, incidents the subject suffered −3.2, problems around the subject, caused by others −1.6.
   anchoranchored

   chain

   ●mainnet-betaslot 461,966,665

   sig

   2tJF6iNcHKwd…7ymG92Pscopyexplorer ↗

   hash

   3JAWoM6KUDoL…xykKgzoscopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (607 B) ▸

   {"actor":"system","decided_at":"2026-10-27T06:07:27.258Z","decision":"rescore","investigation_id":"b80c6b22-2526-403a-880b-03d15b8f5bfa","new_score":47,"page_slug":"betterbank","prev_score":28,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 47. Problems weighed by who is responsible: concerns that are not fraud −12.8, incidents the subject suffered −3.2, problems around the subject, caused by others −1.6.","score_delta":19,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision cec7765a-0c66-4604-ba1d-4ac019ebb997copy
3. #3reviewby reviewerreviewer

   2026-11-02 04:59:22Z
   Score: 47 → 47 (no score change)
   The core incident narrative (Aug 26-27 2025 exploit of about $5M, a Zokyo finding downgraded and left unpatched, about $2.7M returned, net loss near $1.4M) is well corroborated. Problems: the SEC action against Richard Heart is described as ongoing though it was dismissed in 2025, the ZachXBT flag is unsupported by any source, the launch date is inconsistent between July and August, and some granular details ($450 Tornado seed, 50M DAI flash loan figures, 309 ETH to Tornado) are not confirmed in the sources I fetched. The Olympix and QuillAudits posts were not fetched.
   anchoranchored

   chain

   ●mainnet-betaslot 464,369,604

   sig

   5HBaacAeiYTM…TBHW1dCrcopyexplorer ↗

   hash

   Hhcj3HyCXwaR…ZTEMxLCPcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1425 B) ▸

   {"actor":"reviewer","artifact_identity":"71eb91d33e5ca0903ebb906d4dab6dde","decided_at":"2026-11-02T04:59:22.408Z","decision":"review","disputed_pct":0.3571,"findings_hash":"GEYa3tPKPWfd43Znf8wji1pvfjTHbawbGbjjcxZjnwPY","investigation_id":"b80c6b22-2526-403a-880b-03d15b8f5bfa","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":47,"omissions":{"material":0,"total":1},"page_content_hash":"1aeb459094c8848d7a76167aaa18a88d2361c2c5e7c6084d7e478c602b5d8253","page_slug":"betterbank","prev_score":47,"reason":"The core incident narrative (Aug 26-27 2025 exploit of about $5M, a Zokyo finding downgraded and left unpatched, about $2.7M returned, net loss near $1.4M) is well corroborated. Problems: the SEC action against Richard Heart is described as ongoing though it was dismissed in 2025, the ZachXBT flag is unsupported by any source, the launch date is inconsistent between July and August, and some granular details ($450 Tornado seed, 50M DAI flash loan figures, 309 ETH to Tornado) are not confirmed in the sources I fetched. The Olympix and QuillAudits posts were not fetched.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":3,"subject_status":"exploited","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 39c8e616-ec8e-4cf8-8033-2938c64de930copy
4. #4review reviseby judgejudge

   2026-11-02 04:59:22Z
   Score: 47 → 47 (no score change)
   The core incident account (the August 26-27, 2025 exploit of about $5M, the Zokyo finding that was downgraded and left unpatched, and the roughly $2.7M returned) is confirmed by multiple Tier 1 sources (claim_findings[5], [6], [9]). However, 6 of 14 claims (about 43%) are outdated or unverifiable. The page describes the SEC case against Heart and PulseChain as ongoing though it was dismissed in 2025 (claim_findings[0]). It also states as fact that ZachXBT flagged the protocol, which no source supports (claim_findings[1], [2]). The launch date conflicts between July and August (claim_findings[3], [4]), and the flash-loan figures could not be checked. The penalty is kept toward the lower end of the band because the disputed items are mostly peripheral to the main allegation and the reviewer's confidence is moderate.
   anchoranchored

   chain

   ●mainnet-betaslot 464,369,609

   sig

   2RmsaiJMEYcK…gSgxejtycopyexplorer ↗

   hash

   AnKB9wygsany…MXkmuc4vcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1469 B) ▸

   {"actor":"judge","artifact_identity":"71eb91d33e5ca0903ebb906d4dab6dde","band_override":null,"decided_at":"2026-11-02T04:59:22.408Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.3571,"investigation_id":"b80c6b22-2526-403a-880b-03d15b8f5bfa","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":47,"page_slug":"betterbank","prev_score":47,"reason":"The core incident account (the August 26-27, 2025 exploit of about $5M, the Zokyo finding that was downgraded and left unpatched, and the roughly $2.7M returned) is confirmed by multiple Tier 1 sources (claim_findings[5], [6], [9]). However, 6 of 14 claims (about 43%) are outdated or unverifiable. The page describes the SEC case against Heart and PulseChain as ongoing though it was dismissed in 2025 (claim_findings[0]). It also states as fact that ZachXBT flagged the protocol, which no source supports (claim_findings[1], [2]). The launch date conflicts between July and August (claim_findings[3], [4]), and the flash-loan figures could not be checked. The penalty is kept toward the lower end of the band because the disputed items are mostly peripheral to the main allegation and the reviewer's confidence is moderate.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 4ae6458a-7ddb-477f-b032-d1ed8a66bf55copy
5. #5rescoreby systemsystem

   2026-11-02 04:59:23Z
   Score: 47 → 55 (+8)
   Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 47 → 55. Problems weighed by who is responsible: concerns that are not fraud −6.4, incidents the subject suffered −3.2, problems around the subject, caused by others −0.8; 3 section(s) set aside until a failed fact-check is resolved.
   anchoranchored

   chain

   ●mainnet-betaslot 464,369,614

   sig

   4sy4ntrJoxuw…64K76uvGcopyexplorer ↗

   hash

   3DoRovDy5rnV…DG3FMnXicopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (716 B) ▸

   {"actor":"system","decided_at":"2026-11-02T04:59:22.408Z","decision":"rescore","investigation_id":"b80c6b22-2526-403a-880b-03d15b8f5bfa","new_score":55,"page_slug":"betterbank","prev_score":47,"reason":"Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 47 → 55. Problems weighed by who is responsible: concerns that are not fraud −6.4, incidents the subject suffered −3.2, problems around the subject, caused by others −0.8; 3 section(s) set aside until a failed fact-check is resolved.","score_delta":8,"score_model":"v2","sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 66885f2a-9152-4a91-b4bc-ab2f8c38370fcopy