TENDRIL Liquidity Pool Drained of 555,670 USD in PancakeSwap Flash-Loan Exploit

Security researchers have confirmed that decentralized finance project TENDRIL suffered an exploit on November 4, 2026, draining approximately 555,670 USD in digital stablecoins from its primary trading pool on PancakeSwap.

By Marcus Reid | November 10, 2026

For everyday cryptocurrency investors, decentralized finance offers the exciting promise of trading assets directly without relying on a centralized bank or corporate exchange. Rather than placing trust in a corporate custodian, investors deposit their funds into shared piggy banks known as liquidity pools, which allow other traders to swap between tokens automatically while depositors earn a portion of the trading fees. However, this open design comes with significant hazards. When a flawed project introduces vulnerable code into one of these shared pools, malicious actors can exploit the system in seconds, leaving regular token depositors with unrecoverable financial losses.

Market sentiment remains decidedly cautious across the broader digital asset landscape. With Bitcoin trading near 73,424 USD and Ethereum hovering around 2,043 USD, the Crypto Fear & Greed Index sits at 32 in deep Fear territory. In an environment where investors are already guarding their capital against market volatility, sudden smart contract exploits serve as a painful reminder that code-level oversights can instantly wipe out user savings. The drain of more than half a million dollars from the TENDRIL liquidity pair demonstrates how custom token engineering can backfire when paired with standard decentralized exchange infrastructure.

The Incident

The security incident unfolded rapidly on November 4, 2026, centering on the TENDRIL trading pool on PancakeSwap V2, a major decentralized exchange operating on the BNB Chain. In the span of a single blockchain block, an opportunistic attacker identified an opening within the token contract, drained the shared liquidity pool of 555,670 USD in Tether stablecoins, and left the remaining token balance virtually worthless.

To execute the extraction without risking personal capital, the attacker utilized a common decentralized finance mechanism known as a flash loan. A flash loan functions like an instantaneous, zero-collateral loan that must be borrowed and returned within the exact same second. If the borrower cannot return the borrowed capital plus fees before the transaction finishes, the entire transaction is cancelled by the blockchain as if it never happened. In this incident, the attacker borrowed over 30 million USD in stablecoins from an automated lending vault, used that immense temporary buying power to manipulate the trading pool, triggered the vulnerability, and paid back the loan instantly—pocketing the extracted profit.

• Total Capital Extracted — 555,670 USD in stablecoin liquidity was drained from the trading pair.
• Flash Loan Leverage — over 30 million USD was temporarily borrowed and repaid in a single transaction.
• Underlying Network — the incident occurred on PancakeSwap V2 on the BNB Chain.

Following the Money

Blockchain ledgers provide a transparent public record of financial transactions, allowing on-chain forensic analysts to reconstruct the attacker’s movements before and after the exploit. Threat intelligence firms, including CertiK, BlockSec, and Blockint.ai, immediately began tracing the flow of funds to uncover how the attack was financed and where the stolen proceeds ended up.

The investigation showed that the attacker spent days preparing the operation before executing the attack. The primary funding address used to pay network transaction fees had been primed through multiple staged withdrawals from decentralized privacy protocol Tornado Cash on the BNB Chain. I traced the attacker’s funding address on the blockchain: multiple deposits originated directly from Tornado Cash privacy contracts before the flash loan was triggered.

Once the multi-stage transaction executed, the attacker satisfied the massive flash-loan repayment obligations to the lending vault. After deducting transaction costs and network execution fees, a net profit of approximately 309,000 USD in stablecoins was routed into a dedicated holding wallet. Forensic trackers confirmed that the 309,000 USD balance remained parked in that address following the incident, where analytics firms and law enforcement monitors have placed the address under continuous watch for any transfers toward secondary cross-chain bridges or centralized conversion desks.

The Weak Point

To understand how more than half a million dollars vanished in seconds, everyday investors need to understand how automated decentralized exchanges work. Platforms like PancakeSwap operate as automated digital cashier booths. Rather than matching individual buyers and sellers on an order book, they rely on a mathematical equation that balances the ratio of two tokens held in a shared vault. If that balance is artificially distorted, the cashier booth will sell assets at severely distorted rates.

Importantly, the security failure was not caused by a bug in PancakeSwap itself. Instead, the vulnerability lived entirely within TENDRIL‘s custom smart contract code. Smart contracts are self-executing computer programs that act like digital vending machines, releasing tokens and executing transactions only when specific preset rules are met. The creators of TENDRIL designed their token with a custom 30 percent fee on every sale, known as a sell-tax hook.

Whenever an investor sold tokens, the contract automatically diverted a portion of the transaction into a dedicated tax-control contract called _poolControl. This contract contained functions named controlburn() and sync(), which were intended to burn a portion of the tax tokens and update the recorded inventory of the liquidity pool. However, the programmers made a critical sequencing mistake: the contract burned tokens and forced the pool to recount its reserves before the seller’s actual token deposit had finished arriving.

Imagine returning merchandise to a department store customer service desk. If the cash register calculates your refund and updates its inventory ledger before you actually hand over the returned items, an exploiter can manipulate that premature count. By feeding a delayed input into the flawed contract, the attacker made the automated cashier booth believe the pool’s token reserves had collapsed to near zero, causing the system to hand over 555,670 USD in stablecoins for a fraction of their actual economic worth.

How the Industry Responded

Following the exploit, leading blockchain security platforms quickly published incident reports to clarify the scope of the damage. Security firms confirmed that standard PancakeSwap V2 trading pools were unaffected and that users trading established digital assets were not in danger. The damage was strictly confined to liquidity providers and token holders participating in the TENDRIL contract pair.

The incident reignited debate across the decentralized finance development community regarding tokens that incorporate non-standard transfer hooks. Automated market makers are engineered to assume that tokens behave predictably according to standard blockchain interfaces. When developers layer complex transfer taxes, automatic burns, and forced reserve synchronizations onto tokens, they frequently introduce unexpected side effects that external audits fail to detect.

Industry analysts noted that while centralized exchange breaches have captured global headlines in recent weeks, smaller decentralized exploits continue to quietly siphon retail savings. Without comprehensive smart contract verification and rigorous economic testing of custom hooks, automated protocols remain vulnerable to exploiters who specialize in finding sequencing flaws inside secondary contracts.

Lessons for Your Wallet

For everyday cryptocurrency participants, the loss of 555,670 USD from a decentralized pool provides essential defensive lessons. While earning yields by depositing assets into liquidity pools can be appealing, it carries distinct technical risks that regular investors must carefully evaluate before committing their hard-earned money.

First, retail investors should maintain a sharp distinction between exchange safety and token safety. Decentralized exchanges are open and permissionless, meaning anyone can deploy a token and pair it with stablecoins without undergoing an official platform vetting process. Just because a project trades on a recognized platform does not mean the underlying software is safe or well-audited.

Second, tokens that feature heavy sales taxes or complex burn mechanics carry elevated smart contract risk. Projects that advertise high transfer fees to reward holders or fund community treasuries often rely on non-standard programming hooks that create security loopholes. Sticking to battle-tested, standard assets significantly reduces exposure to unexpected smart contract exploits.

• Verify Contract Audits — confirm that any project with non-standard tokenomics has undergone thorough third-party code reviews.
• Beware Complex Tax Hooks — avoid tokens that enforce heavy transaction taxes or automatic pool rebalancing functions.
• Manage Liquidity Exposure — remember that providing stablecoins to an experimental pool leaves your funds vulnerable if the companion token breaks.

Marcus Reid’s take

Bolting experimental taxation logic onto standard automated market makers turns everyday trading pools into ticking financial traps. My gaze remains locked on the exploiter’s wallet to see when that dormant 309,000 USD in extracted stablecoins begins moving toward secondary bridges. Should decentralized exchanges enforce mandatory protocol-level restrictions against re-synchronizing pool balances during active swaps, I would view these customized token designs as significantly safer.

The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.