An attacker exploited a bug in the TENDRIL token's sell logic to drain nearly all USDT from its PancakeSwap V2 liquidity pool on BNB Chain, resulting in a net loss of approximately $555,000.
The exploit targeted the TENDRIL/USDT pool on November 5, 2026, according to security researchers.
How the attack worked
The vulnerability lay in TENDRIL's sell hook, a custom function that executes when tokens are sold. Security researchers traced the attack to function calls including PoolControl.sellToken, combined with a controlled burn operation. The attacker used the burn to manipulate the token's reserves before external transfers had completed.
This allowed the attacker to alter the numbers the pool relied on for pricing while a sale was still in progress. Once reserves were distorted, the pool treated TENDRIL as far more valuable relative to USDT than it should have been.
Automated market makers like PancakeSwap price assets based on the ratio of tokens in a pool. By artificially shrinking one side, the other side appears cheap to withdraw. The attacker used this gap to pull out nearly the entire USDT balance.
On-chain data shows that during the exploit, the attacker sent 30,000 USDT to a hardcoded beneficiary address.
Discrepancies in loss estimates
Loss estimates vary. The headline figure is a net loss of about $555,000, with research findings citing roughly $550,000 in USDT drained in total. Early alerts from monitoring service TenArmorAlert initially pegged losses at approximately $309,000.
The gap reflects differing approaches to calculating net losses versus attacker profits. A pool's total drained balance, the attacker's take after costs, and the victims' net loss can all produce different totals from the same transactions.
Security teams at ExVul and ScaleBit issued public alerts about the attack on November 5, 2026, disclosing the vulnerable token contract, the affected pair address, and relevant transaction data.
Custom tokens, custom risks
TENDRIL had little visibility before this incident. The pattern is familiar on BNB Chain: developers add tax, burn, or reflection logic to standard token templates, creating distinctive tokenomics. Each modification adds code paths that interact with the AMM in ways the original templates never anticipated.
When those paths let a user alter pool reserves mid-transaction, the AMM's pricing math stops protecting liquidity providers.
CertiK continues to track incidents like this one as part of its Web3 security dashboard, which monitors losses, attack vectors, and chain-level risk across quarters. The TENDRIL drain now joins that running tally for the second half of 2026.
Implications for DeFi users and builders
For TENDRIL holders, the immediate problem is liquidity. With nearly all USDT withdrawn, there is very little left on the other side of the pool to absorb sells.
For liquidity providers more broadly, a well-audited exchange cannot protect a pool from a token that rewrites its own reserves.
Builders face a clearer takeaway: sell hooks and burn functions that touch pool balances need strict ordering, so that state changes happen only after transfers are complete. The TENDRIL exploit appears to have turned on exactly that sequencing failure, the kind of issue independent audits are designed to catch.
