An attacker exploited a flaw in the TENDRIL token’s sell logic to withdraw nearly all the USDT from the TENDRIL/USDT liquidity pool on PancakeSwap V2 on BNB Chain. The attack occurred on November 5, 2026, and allowed reserves to be manipulated during a transaction, distorting the token’s valuation by the pool mechanism. Approximately 550,000 USDT was drained, resulting in an estimated net loss of $555,000, while the beneficiary address received 30,000 USDT. TenArmorAlert initially estimated losses at around $309,000, with the discrepancy reflecting different methods for calculating net losses and attacker profits. The incident highlights the risks associated with custom sell and burn functions that alter the execution order of transfers and reserve updates.
Source: Read the original article
