TENDRIL

What happened

On November 5, 2026, an attacker exploited TENDRIL's token sell logic to drain approximately 550,000 USDT from its PancakeSwap V2 liquidity pool on BSC. Each sell triggered PoolControl.sellToken(), which called TENDRIL.controlburn() to burn tokens directly from the liquidity pair and synchronize its reserves before the seller's remaining tokens arrived. The attacker used flash-loan-funded transactions to exploit the resulting reserve imbalance and withdraw nearly all the pool's USDT liquidity. ExVul estimated the attacker's campaign profit at no more than 181,910 USDT after observed purchases and gas costs, excluding an unresolved LP-position basis

Details

Date

Nov 5, 2026

Kind

Hack or exploit

Method

Swap Logic Flaw

How in

Smart contract bug

Target

DeFi protocol or token

Chains

BNB Chain

What would have stopped it all controls for this way in

• Invariants (solvency, supply, share price) are written down and fuzzed or proven on every function that changes a balance.
  Check: An invariant suite runs in CI; each balance-changing function is covered.
• A whitehat Safe Harbor or bounty offer is published before any attack, so a rescuer or an attacker has a set way to return funds.
  Check: The terms and the return address are public and fixed in advance.

General guidance for this kind of attack, not a finding about this incident.

How sure: 2 of 4 checks what the checks mean

• Witnesses2 independent sources report it
• Same storythey agree on the date and the loss
• Blockchain receiptno public attack transaction checked
• Official wordno official statement linked

Who says what

• DefiLlama ↗$550K
• SlowMist Hacked ↗$555K

Figure used: $550K, the figure DefiLlama gives. Each source's own figure is in dollars at the time.

Related incidents