Anatomy of the TENDRIL Liquidity Pool Exploit
Decentralized finance security researchers have uncovered the mechanics behind a major liquidity drain targeting the TENDRIL token on BNB Chain. The incident centered on a structural vulnerability involving specific function calls, including PoolControl.sellToken, combined with an unauthorized, controlled burn operation. According to technical disclosures, the attacker exploited this burn mechanism to alter the token’s reserve metrics before external transfer operations could conclude.
Because the smart contract allowed external interactions to modify the underlying reserve metrics while a token sale was still executing, the pricing framework was compromised. Once these reserves were distorted, the automated market maker (AMM) treated TENDRIL as significantly more valuable relative to Tether (USDT) than its true market value. Automated exchange environments like PancakeSwap calculate asset values using the ratio of paired tokens within a liquidity pool. By artificially deflating one side of the equation, the paired asset becomes disproportionately inexpensive to withdraw. The attacker leveraged this state discrepancy to extract virtually the entire USDT reserve, while on-chain data revealed an intentional transfer of 30,000 USDT directly to a hardcoded beneficiary address.
Loss Estimates and Differing On-Chain Calculations
Analytical assessments of the incident’s damage have diverged based on the evaluation methods employed across different security firms. Headline figures estimate the net loss at approximately $555,000, aligning closely with research findings detailing around $550,000 in drained USDT. Earlier automated alerts from monitoring provider TenArmorAlert originally estimated the damage at roughly $309,000.
The variation stems from fundamental differences in assessing total drained liquidity, net protocol losses, and actual attacker profits following transaction costs and slippage. On November 5, 2026, blockchain security teams from ExVul and ScaleBit published comprehensive public alerts detailing the attack vector. Their technical reports documented the specific vulnerable TENDRIL contract, the compromised trading pair address, and transaction hashes, establishing a verified on-chain trail for forensic investigators.
Custom Tokenomics and the Vulnerability of AMM Pricing
Prior to the exploit, TENDRIL held minimal visibility within the broader Web3 ecosystem. However, the vector reflects an ongoing architectural problem frequently observed on BNB Chain: the integration of non-standard tokenomics models. Developers often append tax mechanisms, automated burns, or reflection algorithms onto standardized token frameworks to market bespoke economic structures. Each custom layer adds complex code paths that interface with decentralized exchanges in ways standard AMM templates were not engineered to handle.
When custom execution hooks allow reserve states to change mid-flight, the mathematical safeguards of automated market makers cease to protect participants. Blockchain analytics and security firm CertiK has logged the incident into its Web3 security monitoring dashboard, tracking the exploit alongside broader second-half 2026 loss vectors, vulnerability trends, and network-level risk profiles.
Why This Matters
The TENDRIL exploit highlights a persistent structural vulnerability in decentralized finance: liquidity pools hosted on battle-tested, thoroughly audited decentralized exchanges remain vulnerable if the underlying token contract possesses flawed internal logic. For TENDRIL token holders, the pool’s collapse leaves remaining assets effectively illiquid, as minimal USDT remains to absorb outgoing sell pressure.
For smart contract developers, the incident underscores the critical necessity of rigorous reentrancy protections and strict execution ordering. Any custom functions—such as burn operations, sell hooks, or reflection distributions—that impact pool reserves must enforce non-reentrant checks and update internal states strictly after all token transfers have fully resolved.
Frequently Asked Questions
How did the attacker manipulate the price of TENDRIL on PancakeSwap?
The attacker utilized a controlled burn via the PoolControl.sellToken function while a sale was executing. This changed the token reserves inside the liquidity pool mid-transaction, artificially inflating TENDRIL’s exchange rate relative to USDT and allowing the exploiter to withdraw nearly all paired USDT liquidity.
How much capital was lost during the TENDRIL exploit?
Estimates range from an initial figure of around $309,000 reported by TenArmorAlert to approximately $550,000 to $555,000 in total drained USDT identified in follow-up analyses by ScaleBit, ExVul, and other forensic investigators.
Why was PancakeSwap’s security unable to prevent the drain?
The flaw resided directly inside the custom logic of the TENDRIL token smart contract rather than PancakeSwap’s AMM core contracts. When a paired token contract permits internal balances to be manipulated mid-execution, the exchange’s pricing algorithms rely on inaccurate reserve figures, rendering the AMM powerless to prevent the imbalance.
