NEM token exploited via permissionless LP-burn reserve manipulation, draining $821K USDT from PancakeSwap pair using flash-loaned capital and repeated pair sync calls.
Security & Exploits ·
The NEM token on BNB Chain fell victim to a logic exploit that drained approximately $821,000 USDT from its PancakeSwap liquidity pool on October 21, 2026. The token's NemTokenV2 contract contains a permissionless mechanism designed to burn up to 20% of the pair's own NEM balance and trigger a pool sync, a feature intended as deflationary but weaponized by an attacker who profited roughly $726,000 after loan repayment.
The exploit leveraged flash loans from multiple sources to build USDT reserves in the pair, then executed a 42-iteration loop that repeatedly burned the pool's NEM holdings down to approximately 29 tokens while leaving the USDT reserve untouched. This manipulation of the constant-product curve's reserves allowed the attacker to swap a minimal NEM input for an outsized output of approximately 236.6 million USDT, draining the NEM/USDT liquidity pool. The attacker funded the operation using a Tornado-mixed address, masking the capital's origin.
The vulnerability hinged on the permissionless nature of the LP-burn recycling function, which lacked access controls to prevent repeated manipulation in a single transaction. No details have emerged about whether the NEM team plans to patch the mechanism or compensate affected liquidity providers.