Medium0xCERT-2026-0324·2026-11-05

TENDRIL Sell-Hook Reserve Drain

A flaw in the TENDRIL token's custom sell hook let an attacker desync its PancakeSwap V2 reserves with a controlled burn and drain roughly $555,000 in USDT on BNB Chain.

Vuln-watch · relayed from a public source; see Source & attribution below

Affected chainsBNB Chain

Summary

A flaw in the TENDRIL token's custom sell hook let an attacker desync its PancakeSwap V2 reserves with a controlled burn and drain roughly $555,000 in USDT on BNB Chain.

Incident

Victim: TENDRIL
Date (UTC): 2026-11-05
Estimated loss: $555k
Chain(s): BNB Chain
Attack type: smart-contract exploit
Funds status: stolen

Recommended actions

Revoke token approvals granted to TENDRIL contracts until the project confirms they are safe
Integrators: pause or delist affected assets and monitor for attacker fund movements
Beware of follow-on phishing: ignore unofficial "refund", "recovery", or "claim" links and DMs; use the project's verified channels only

Source & attribution

Full analysis on Blockchain Breaches, 0xCERT's incident archive: https://www.blockchainbreaches.com/en/breaches/tendril-2026. Primary sources: https://cryptobriefing.com/tendril-exploit-555k-usdt-loss-bnb-chain/ ; https://phemex.com/news/article/tendril-sell-mechanism-flaw-leads-to-555k-in-losses-102479.

References

Indicators of compromise

All IOC feeds →

address0xb81e4aafa347b27112b7f6f5de6cf7cd516021ffTENDRIL attacker EOA - per Defimon Alerts · BNB Chain
tx0x465d8ef4eb8d6fb2878e2ffd642ff72bd405362b8944861c94d7c9bfd88ca5a4Related pre-attack transaction (attacker-created V3 pool position) - per BlockSec Phalcon · BNB Chain
tx0xfdff4fba4327821c204af07944076ecaaee163a994398fdf4063d08712e40059TENDRIL/USDT pool exploit transaction - per BlockSec Phalcon, CertiK Alert, TenArmor, Defimon · BNB Chain

OpenPGP-signed. The signed text of this advisory verifies against the 0xCERT key CCC7 D9EC 9415 723D.

Published 2026-11-05 · last updated 2026-11-08

curl -s https://www.0xcert.com/pgp.asc | gpg --import && curl -s https://www.0xcert.com/advisory/0xCERT-2026-0324/signed.txt | gpg --verify