Tendril exploit drains roughly $555K in USDT after sell hook flaw

An attacker abused a bug in the TENDRIL token's sell logic to pull nearly all USDT from its PancakeSwap V2 pool on BNB Chain A small token on BNB Chain just learned an expensive lesson about custom code. A flaw in TENDRIL’s sell hook let an attacker withdraw nearly all of the USDT backing the token, producing a net loss of about $555,000. The exploit hit the TENDRIL/USDT liquidity pool on PancakeSwap V2 on November 5, 2026. How the TENDRIL attack worked The weak point was the token’s sell logic. Many tokens on BNB Chain add custom behavior that fires whenever someone sells, such as fees, burns or reserve adjustments. That extra code is usually called a hook. Security researchers traced the attack to function calls including PoolControl.sellToken, paired with a controlled burn operation. According to the disclosures, the attacker used that burn to manipulate the token’s reserves before external transfers had finished executing. The contract let the attacker change the numbers the pool relied on for pricing while a sale was still in progress. Once those reserves were distorted, the pool treated TENDRIL as far more valuable relative to USDT than it should have been. Automated market m...