{"investigation":{"slug":"bsc-tmmusdt","entity_name":"BSC TMM/USDT","trust_score":12,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"BSC TMM/USDT is a Binance Smart Chain token pair that was exploited on April 4, 2026, via a flash loan-based reserve manipulation attack, resulting in an estimated loss of $1.665 million USDT. The attacker burned TMM tokens to a dead address to artificially skew pool reserves, then extracted USDT through a Constant Product Market Maker (CPMM) pricing imbalance. The TMM token contract lacked reserve synchronization on burn operations and had no verified third-party security audit on file.","sections":[{"content":"On approximately April 4, 2026, the TMM/USDT liquidity pool on Binance Smart Chain (BSC) — pool address 0xc36c718e7d0af055092e5274f92f6511820ca041 — was drained in a reserve manipulation attack. The attacker used an attacker contract at 0x1c5e8d3501bbcae900e14d8720774d9ff6ec7203 to orchestrate flash loans from five separate DeFi protocols: ListaDAO Moolah, Venus, Aave V3, PancakeSwap Vault, and Uniswap PoolManager. By sourcing liquidity across multiple venues, the attacker avoided individual borrowing caps while assembling the capital needed for the attack. After accumulating the borrowed USDT, the attacker burned a large quantity of TMM tokens directly to the canonical burn address (0x000000000000000000000000000000000000dEaD), reducing the pool's TMM reserve to just 1 TMM. Because the pool's pricing mechanism relies solely on the ratio of current reserves (the CPMM x*y=k formula), and because the pool did not perform a reserve sync following the burn transfer, it perceived an extreme imbalance. The attacker then swapped approximately 850 million TMM back into the pool, which the pool priced as extremely valuable due to the artificially reduced TMM reserve, and received approximately 272 million USDT in return. After repaying all flash loan obligations, a net profit of 1,665,255 USDT was transferred to wallet 0xe4edfa3fbf238c3598b73f76bc15286b6496cd0c. Total victim losses are reported at approximately $1.665 million.","heading":"Exploit Overview","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-tmm-hack-april-2026","name":"halborn.com","type":"other","credibility":3},{"url":"https://phemex.com/news/article/bsc-network-hit-by-tmmusdt-reserve-manipulation-attack-1665-million-lost-71016","name":"phemex.com","type":"other","credibility":3},{"url":"https://x.com/exvulsec/status/2040649377803546859","name":"x.com","type":"other","credibility":3},{"url":"https://hacked.slowmist.io/?c=BSC&page=1","name":"hacked.slowmist.io","type":"other","credibility":3}],"severity":"medium"},{"content":"The core vulnerability enabling the attack was the pool's failure to synchronize its internal reserve accounting when tokens were transferred to or burned from external addresses. Standard secure CPMM implementations call a sync function after any balance-affecting operation so that the pool's tracked reserves match actual on-chain balances. The TMM/USDT pool omitted this protection. When TMM tokens were burned to the dead address, the actual circulating supply decreased but the pool's stored reserve figure was not updated, creating a phantom imbalance the attacker could exploit. This class of vulnerability is recognized in the DeFi security community as a reserve manipulation attack and has been observed in multiple BSC-based pool contracts. Halborn's post-mortem confirms the root cause as the pool lacking 'sync operations for its reserves in response to a transfer or burn operation.' The TMM token contract (0x1d6f03b0b20b2ec05b37bf60f56af442ced66666) uses an ERC-1967 upgradeable proxy pattern and was compiled with Solidity v0.8.24. BscScan records indicate no third-party security audit has been submitted for the contract.","heading":"Root Cause: Reserve Sync Vulnerability","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-tmm-hack-april-2026","name":"halborn.com","type":"other","credibility":3},{"url":"https://bscscan.com/token/0x1d6f03b0b20b2ec05b37bf60f56af442ced66666","name":"bscscan.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The following on-chain addresses are central to the exploit and are publicly documented in security alerts and post-mortems. The TMM token contract is 0x1d6f03b0b20b2ec05b37bf60f56af442ced66666 on BSC. The targeted CPMM liquidity pool is 0xc36c718e7d0af055092e5274f92f6511820ca041. The attacker's deployment contract is 0x1c5e8d3501bbcae900e14d8720774d9ff6ec7203. Profits of 1,665,255 USDT were transferred to the profit recipient wallet 0xe4edfa3fbf238c3598b73f76bc15286b6496cd0c. At the time of investigation, the token contract shows approximately 11,294 holder addresses and a total supply of 10,000,000,000 TMM. The current market price is reported as effectively zero due to the collapse of liquidity following the exploit. No on-chain recovery or fund return has been publicly documented.","heading":"On-Chain Addresses of Interest","sources":[{"url":"https://x.com/exvulsec/status/2040649377803546859","name":"x.com","type":"other","credibility":3},{"url":"https://bscscan.com/token/0x1d6f03b0b20b2ec05b37bf60f56af442ced66666","name":"bscscan.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-tmm-hack-april-2026","name":"halborn.com","type":"other","credibility":3}],"severity":"medium"},{"content":"TMM Group describes itself as a multi-utility blockchain token launched in February 2021 and operating primarily in Asian and African markets. According to the project's stated roadmap, TMM planned to offer DeFi staking, wallet services, a payment gateway, a cryptocurrency exchange, e-commerce, hotel booking, online gaming, and real estate services. The project's GitHub organization (github.com/tmm-token) hosts a single public repository containing the Solidity contract source. The project website (tmmtoken.com) was inaccessible at the time of this investigation. No named founders, team members, or legal entity disclosures have been independently verified. The token's total supply of 10 billion tokens and its upgradeable proxy architecture are relevant risk factors: upgradeable contracts can be modified post-deployment and may introduce new vulnerabilities or administrative backdoors without token holder consent.","heading":"Project Background","sources":[{"url":"https://github.com/tmm-token","name":"github.com","type":"other","credibility":3},{"url":"https://bscscan.com/token/0x1d6f03b0b20b2ec05b37bf60f56af442ced66666","name":"bscscan.com","type":"other","credibility":3}],"severity":"medium"},{"content":"No security audit has been submitted or linked for the TMM token contract on BscScan. The Halborn post-mortem of the April 2026 attack does not reference any prior audit engagement. The reserve sync vulnerability exploited in this attack is a well-documented smart contract flaw that a competent audit would typically flag. The absence of any audit record, combined with the confirmed exploit, indicates the project either did not commission an audit or did not publish one. The contract also carries a noted low-severity Solidity compiler warning related to LostStorageArrayWriteOnSlotOverflow, which further reflects insufficient pre-deployment review.","heading":"Security Audit Status","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-tmm-hack-april-2026","name":"halborn.com","type":"other","credibility":3},{"url":"https://bscscan.com/token/0x1d6f03b0b20b2ec05b37bf60f56af442ced66666","name":"bscscan.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the April 2026 reserve manipulation attack, the TMM token's on-chain liquidity was effectively destroyed. The price is reported at $0.00 on BscScan with no active market data. The pool at 0xc36c718e7d0af055092e5274f92f6511820ca041 had its USDT reserves drained to fund the attacker's 1.665 million USDT profit. No public statement from the TMM project team regarding the exploit, compensation for affected users, or remediation steps has been identified. The attack was flagged in Halborn's April 2026 monthly DeFi hacks roundup and is listed in the SlowMist hacked database. The 11,294 holder addresses recorded on BscScan represent users who may hold effectively worthless tokens with no functioning secondary market.","heading":"Market Impact and Post-Exploit Status","sources":[{"url":"https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-april-2026","name":"halborn.com","type":"other","credibility":3},{"url":"https://hacked.slowmist.io/?c=BSC&page=1","name":"hacked.slowmist.io","type":"other","credibility":3},{"url":"https://bscscan.com/token/0x1d6f03b0b20b2ec05b37bf60f56af442ced66666","name":"bscscan.com","type":"other","credibility":3},{"url":"https://phemex.com/news/article/bsc-network-hit-by-tmmusdt-reserve-manipulation-attack-1665-million-lost-71016","name":"phemex.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-02","event":"TMM Group token reportedly launched on BSC, targeting DeFi and multi-utility use cases in Asian and African markets.","source":"","date_original":"2021-02-01"},{"date":"2026-04-04","event":"Reserve manipulation attack executed against BSC TMM/USDT pool. Attacker burns TMM to dead address, reducing pool reserves to 1 TMM, then swaps 850 million TMM for ~272 million USDT via flash loans from five DeFi protocols. Net profit of $1,665,255 USDT extracted.","source":""},{"date":"2026-04-05","event":"ExVul security account posts alert on X identifying attacker contract (0x1c5e8d3501bbcae900e14d8720774d9ff6ec7203), target token address, and profit recipient wallet. Phemex publishes news article on the attack.","source":""},{"date":"2026-04-05","event":"SlowMist logs the TMM BSC exploit in its hacked database with a $1,665,000 loss figure.","source":""},{"date":"2026-04","event":"Halborn publishes detailed post-mortem: 'Explained: The TMM Hack (April 2026)', confirming root cause as missing reserve sync on burn operations.","source":"","date_original":"2026-04-01"},{"date":"2026-04-30","event":"Halborn includes TMM in its 'Month in Review: Top DeFi Hacks of April 2026' roundup, listing it among the month's significant losses.","source":""}],"sources_used":[{"url":"https://www.halborn.com/blog/post/explained-the-tmm-hack-april-2026","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260520131345/https://www.halborn.com/blog/post/explained-the-tmm-hack-april-2026","credibility":3,"archive_timestamp":"2026-05-20T13:13:45+00:00"},{"url":"https://phemex.com/news/article/bsc-network-hit-by-tmmusdt-reserve-manipulation-attack-1665-million-lost-71016","name":"phemex.com","type":"other","archive_url":"https://web.archive.org/web/20260829040003/https://phemex.com/news/article/bsc-network-hit-by-tmmusdt-reserve-manipulation-attack-1665-million-lost-71016","credibility":3,"archive_timestamp":"2026-08-29T04:00:03+00:00"},{"url":"https://x.com/exvulsec/status/2040649377803546859","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://hacked.slowmist.io/?c=BSC&page=1","name":"hacked.slowmist.io","type":"other","archive_url":"http://web.archive.org/web/20260218112559/https://hacked.slowmist.io/?c=BSC&page=1","credibility":3,"archive_timestamp":"2026-02-18T11:25:59+00:00"},{"url":"https://bscscan.com/token/0x1d6f03b0b20b2ec05b37bf60f56af442ced66666","name":"bscscan.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://github.com/tmm-token","name":"github.com","type":"other","archive_url":"https://web.archive.org/web/20260829080310/https://github.com/tmm-token","credibility":3,"archive_timestamp":"2026-08-29T08:03:10+00:00"},{"url":"https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-april-2026","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260520132239/https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-april-2026","credibility":3,"archive_timestamp":"2026-05-20T13:22:39+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:17.654541+00:00","updated_at":"2026-08-29T09:21:01.706937+00:00"}}