-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 0xCERT Security Advisory 0xCERT-2026-0263 ============================================================ Advisory-ID: 0xCERT-2026-0263 Severity: Medium Published: 2026-10-22T09:52:05.000Z Updated: 2026-10-22T16:45:38.667Z Chains: BNB Chain URL: https://www.0xcert.com/advisory/0xCERT-2026-0263 Title: NemTokenV2 (NEM) on BNB Chain exploited for about $822k via LP sell-recycle accounting flaw Summary - ------- SlowMist and CertiK report that the NemTokenV2 ($NEM) contract on BNB Chain was exploited for about $822k. The attacker repeated transfer, skim and flushLpSellRecycle 42 times to burn the PancakeSwap USDT/NEM pair reserves, then sold NEM for USDT. Avoid the pool until the project remediates. Details - ------- Summary On 22 October 2026 SlowMist's threat-intelligence team reported that the NemTokenV2 ($NEM) token contract on BNB Chain was exploited for about $821,920. CertiK Alert separately flagged the exploit, estimating losses of about $820,000. Per SlowMist, the attacker abused the token's LP sell-recycle accounting to burn reserves from the PancakeSwap USDT/NEM pair and then sold NEM at the inflated price for USDT. Affected - - NemTokenV2 ($NEM) token contract on BNB Chain (0x9cf0e3ad4efa7ab602d7b5a38c55795cfa777777) and its PancakeSwap USDT/NEM pair (0x840e19dcca541ee0b55a3c67e900a39d523b12b8) - - No fix available at time of publication Impact Per SlowMist, NemTokenV2 credited transfers into the LP pair as sell volume without verifying swap settlement. These credits stayed valid after the transferred tokens were removed via skim(), allowing flushLpSellRecycle() to burn pre-existing LP reserves. The attacker repeated transfer, skim and flush 42 times, lowering the pair's NEM reserves, then sold the remaining NEM to extract USDT. Exploitation in the wild is confirmed, with losses of about $821,920 borne by the pair's liquidity providers. Media reports citing the alerts say the attacker bridged proceeds to Ethereum. Recommended actions - - Do not provide liquidity to, or trade against, the NEM/USDT pair until the project publishes a remediation. - - Exchanges and bridges should screen the attacker address and attack contract listed as indicators. - - Developers of tokens with custom LP-transfer hooks should make sure sell accounting is credited only for settled swaps and cannot be replayed after skim(). Source & attribution This 0xCERT advisory summarises a disclosure by SlowMist (SlowMist TI Alert): https://x.com/SlowMist_Team/status/2113206749524316486, corroborated by CertiK Alert as reported by Crypto Briefing: https://cryptobriefing.com/certik-nem-token-exploit-820k-pancakeswap/. Details may change; refer to the original source for the authoritative record. References - ---------- - - https://x.com/SlowMist_Team/status/2113206749524316486 - - https://cryptobriefing.com/certik-nem-token-exploit-820k-pancakeswap/ - - https://panews.io/articles/01a16316-3935-777e-8dd2-965ee68e99d5 - - https://bscscan.com/tx/0xfb093c96c0094cbcca10801f97ed2e5ed3d96550ce64b544df5a349545723f91 Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc Fingerprint: 5F94 3ED1 1E50 CF31 2128 C493 CCC7 D9EC 9415 723D -----BEGIN PGP SIGNATURE----- wrsEARYKAG0FgmraxYgJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp b25zLm9wZW5wZ3Bqcy5vcmcAdjs0mbPIVJq7OwYngQbC/syFH69u/L7+WU4C oDbF3hYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAABH9AD6A17W326qlr95p+XC IJ0wh1jiA4xKt/yW1GTiZDxXnDAA/2gP+vxE0gYRvbxJ++wYD2B7dhfkrV9e znfw4A636vkG =rGQR -----END PGP SIGNATURE-----