TENDRIL token on BNB Chain: sell-hook flaw lets attacker drain USDT from TENDRIL/USDT pool, about $309K-$555K lost

Summary

On 5 November 2026 the TENDRIL/USDT pool on BNB Chain was exploited. CertiK Alert reports that TENDRIL's sell hook let sellers debit the pair's token balance and sync reserves before the remaining sell input arrived; the delayed input then withdrew nearly all USDT from the pool. TenArmor Alert independently detected the same attack transaction.

Affected

• TENDRIL token (BNB Chain) and its TENDRIL/USDT liquidity pool
• No fix available at time of publication

Impact

An attacker drained nearly all USDT liquidity from the TENDRIL/USDT pool. Exploitation in the wild is confirmed. Loss estimates differ between sources: CertiK Alert puts the net loss at about $555K, while TenArmor Alert's initial estimate was about $309K. Neither source has named the attacker address at the time of publication.

Recommended actions

• Do not buy, sell, or provide liquidity to TENDRIL or the TENDRIL/USDT pool until the project publishes a post-mortem and remediation.
• Token developers: sell hooks or burn logic that touch pair balances must not update balances or call sync() before the incoming transfer completes.
• Monitor the exploit transaction listed below for movement of stolen funds.

Source & attribution

This 0xCERT advisory summarises alerts by CertiK Alert (https://x.com/CertiKAlert/status/2118242639212658985) and TenArmor Alert (https://x.com/TenArmorAlert/status/2118237717574390001), both citing the same exploit transaction. Details may change; refer to the original sources for the authoritative record.