Pendle
Summary
Pendle is a permissionless yield-trading protocol on Ethereum, launched in 2021 by TN Lee and Vu Nguyen, that allows users to separate and trade the principal and yield components of yield-bearing assets. In September 2024, Penpie — an independent yield optimizer built on top of Pendle — suffered a $27 million reentrancy exploit that was made possible in part by Pendle's permissionless market creation design. Although Pendle's own contracts were not directly exploited, the protocol's architecture contributed to the attack surface, and all 11,261 ETH in stolen funds were subsequently laundered through Tornado Cash.
Connected Entities
1 entitiesTimeline(10 events)
2020-11-01
Pendle protocol first introduced under the name Benchmark as an on-chain yield aggregator enabling separation and trading of future yield.
OAK Research / PANews2021-06-16
Pendle Finance launches on Ethereum mainnet, enabling users to mint YT and PT tokens for yield-bearing assets.
OAK Research2023-06-01
Penpie launches as a yield optimizer built on Pendle. Contracts audited by Zokyo and WatchPug before launch. At this stage, only the Penpie team multisig can register new Pendle Markets.
Three Sigma / AuditOne2024-05-01
Penpie introduces permissionless pool registration, allowing any user to register Pendle Markets. AstraSec audits only the new registration contracts; PendleStakingBaseUpg is excluded from scope.
Three Sigma / Cointelegraph2024-05-01
Pendle TVL reaches approximately $5.78 billion, an all-time high at that point, driven by LRT/LST restaking demand.
Unchained Crypto2024-09-03
Penpie exploited via reentrancy in batchHarvestMarketRewards(). Three attack transactions between 6:25 PM and 6:42 PM UTC drain approximately $27 million in wstETH, sUSDe, agETH, rswETH, and Pendle YT tokens across Ethereum and Arbitrum.
Halborn / Three Sigma / Rekt News2024-09-03
Pendle pauses its own contracts in response, protecting an additional approximately $105 million in funds. Both Pendle and Penpie freeze deposits.
CoinMarketCap / Pendle on X2024-09-03
Penpie publicly offers the attacker a negotiated bounty and promises of no legal action in exchange for return of stolen funds. Attacker does not respond.
Penpie on X / Cryptopolitan2024-09-03
Within 12 hours of the exploit, approximately $7 million of stolen funds are laundered through Tornado Cash. PNP token falls approximately 40%; PENDLE falls approximately 9%.
DeFi Planet / Bitcoinist2024-09-07
All 11,261.2 ETH (approximately $26.72 million) confirmed laundered through Tornado Cash in batches of 100 ETH from multiple accounts within approximately four days of the attack. No funds recovered.
DailyCoin / PeckShieldDecision Log
- hash: CoFaVjCEjeN3pVm9pCbczneU1NSsDQGGig9ywbL1Me6n
- hash: B8JNTKF3RTsJuAXX12dmmsTrk42FG7jj5TYwpweXCb2
- hash: 9WyTw69iE2J5GqEcAqdmdwDmQBubo6p6nCRYnUkVB8Nz
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet
generated: 5/4/2026, 4:04:59 PM
last updated: 6/9/2026, 8:09:10 PM
avoid.net — verified advice for a post-truth world