TENDRIL token pool (BNB Chain, November 2026) hack — November 2026
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | November 5, 2026 |
| Target type | Token contract |
| Loss | $555,671Price at time of incident |
| Method | Contract logic errorThe token’s sell hook debited the pair’s TENDRIL balance and synced reserves before the rest of the sell input arrived, so the delayed input then withdrew almost all of the pool’s USDT |
| Chains | BNB Chain |
| Outcome | Unresolved |
What happened
At 16:02:45 UTC on 4 November 2026 an attacker drained nearly all the USDT from the PancakeSwap V2 pool of TENDRIL, a token on BNB Chain. CertiK said the token’s sell hook let a seller debit the pair’s TENDRIL balance and sync its reserves before the rest of the sell input arrived, so that the delayed input could then withdraw almost all of the pool’s USDT.
Our read of the attack transaction, in block 131,653,427, shows the pool losing 555,670.54 USDT, paid out to five addresses, which matches CertiK’s net loss of about $555,000. The attacker may have bought TENDRIL in earlier transactions, so its own profit can be lower than the pool’s loss. The project has not commented and nothing has been returned.
Sources
- CertiK Alert on X (5 November 2026)Secondary · retrieved 2026-11-05
- Attack transaction, BNB Chain block 131,653,427 (read via public RPC)On-chain · retrieved 2026-11-05
Changes to this entry
- Recorded at the pool’s 555,670.54 USDT outflow from our receipt read; trackers date it 5 Nov, the block time is 4 Nov 16:02:45 UTC.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "TENDRIL token pool (BNB Chain, November 2026) hack — November 2026", iTokenly, accessed 2026-11-06, https://itokenly.com/hacks/tendril-bsc-november-2026https://itokenly.com/hacks/tendril-bsc-november-2026Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.