NemTokenV2 exploit: pool reserves burned, ~$820K out

'~$821,920', per SlowMist; ~$820K per BlockSec Phalcon, CertiK and TenArmor.

Root cause: Per SlowMist: 'NemTokenV2 credited transfers into the LP pair as sell volume without verifying swap settlement. These credits remained valid after the transferred tokens were removed via skim(), allowing flushLpSellRecycle() to burn pre-existing LP reserves.'

Timeline, as sourced: Attack tx 21 Oct 2026 03:28:50 UTC (on-chain); TenArmor alert 22 Oct 08:45 UTC; SlowMist 09:52 UTC; Phalcon 10:59 UTC.

An attacker drained the USDT/NEM PancakeSwap pool on BNB Chain through a flaw in the NemTokenV2 token (transaction (opens in a new tab)). According to SlowMist (opens in a new tab), the token credited transfers into the pair as sell volume without checking that a swap had settled, and the credits stayed valid after the tokens were pulled back out with skim(). That let flushLpSellRecycle() burn NEM already in the pool. The attacker repeated transfer, skim and flush 42 times, syncing ever-lower NEM reserves, then sold NEM at the inflated price for USDT. BlockSec Phalcon (opens in a new tab) describes the same mechanism, with each burn set at 70% of the pending amount, capped by the pool balance. SlowMist puts the loss at about $821,920; Phalcon, CertiK (opens in a new tab) and TenArmor give about $820K. The transaction is dated 21 October 2026 on-chain; the firms' alerts followed on 22 October.