Pendle
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·4UeRYJ…fCJ8Summary
Pendle is a permissionless yield-trading protocol on Ethereum, launched in 2021 by TN Lee and Vu Nguyen, that allows users to separate and trade the principal and yield components of yield-bearing assets. In September 2024, Penpie — an independent yield optimizer built on top of Pendle — suffered a $27 million reentrancy exploit that was made possible in part by Pendle's permissionless market creation design. Although Pendle's own contracts were not directly exploited, the protocol's architecture contributed to the attack surface, and all 11,261 ETH in stolen funds were subsequently laundered through Tornado Cash.
Connected Entities
5 entities · 60 linked investigations- Balancer→mentioned with→Arbitrum(60%)
- Balancer→mentioned with→Ethereum(70%)
- Penpie→mentioned with→Pendle(80%)
- Pendle→mentioned with→Penpie(80%)
- Pendle→mentioned with→Arbitrum(70%)
- Pendle→mentioned with→Ethereum(80%)
- Pendle→mentioned with→Balancer(60%)
- Penpie→mentioned with→Arbitrum(70%)
- Penpie→mentioned with→Ethereum(70%)
- Penpie→mentioned with→Balancer(60%)
- + 2 more
Timeline(10 events)
November 2020
Pendle protocol first introduced under the name Benchmark as an on-chain yield aggregator enabling separation and trading of future yield.
OAK Research / PANews16 June 2021
Pendle Finance launches on Ethereum mainnet, enabling users to mint YT and PT tokens for yield-bearing assets.
OAK ResearchJune 2023
Penpie launches as a yield optimizer built on Pendle. Contracts audited by Zokyo and WatchPug before launch. At this stage, only the Penpie team multisig can register new Pendle Markets.
Three Sigma / AuditOneMay 2024
Penpie introduces permissionless pool registration, allowing any user to register Pendle Markets. AstraSec audits only the new registration contracts; PendleStakingBaseUpg is excluded from scope.
Three Sigma / CointelegraphMay 2024
Pendle TVL reaches approximately $5.78 billion, an all-time high at that point, driven by LRT/LST restaking demand.
Unchained Crypto3 September 2024
Penpie exploited via reentrancy in batchHarvestMarketRewards(). Three attack transactions between 6:25 PM and 6:42 PM UTC drain approximately $27 million in wstETH, sUSDe, agETH, rswETH, and Pendle YT tokens across Ethereum and Arbitrum.
Halborn / Three Sigma / Rekt News3 September 2024
Pendle pauses its own contracts in response, protecting an additional approximately $105 million in funds. Both Pendle and Penpie freeze deposits.
CoinMarketCap / Pendle on X3 September 2024
Penpie publicly offers the attacker a negotiated bounty and promises of no legal action in exchange for return of stolen funds. Attacker does not respond.
Penpie on X / Cryptopolitan3 September 2024
Within 12 hours of the exploit, approximately $7 million of stolen funds are laundered through Tornado Cash. PNP token falls approximately 40%; PENDLE falls approximately 9%.
DeFi Planet / Bitcoinist7 September 2024
All 11,261.2 ETH (approximately $26.72 million) confirmed laundered through Tornado Cash in batches of 100 ETH from multiple accounts within approximately four days of the attack. No funds recovered.
DailyCoin / PeckShieldDecision Log
- hash: CoFaVjCEjeN3pVm9pCbczneU1NSsDQGGig9ywbL1Me6n
- hash: B8JNTKF3RTsJuAXX12dmmsTrk42FG7jj5TYwpweXCb2
- hash: 9WyTw69iE2J5GqEcAqdmdwDmQBubo6p6nCRYnUkVB8Nz
This investigation is cryptographically anchored to the Solana blockchain (3 events).
model: claude-sonnet
generated: 5/4/2026, 4:04:59 PM
last updated: 6/9/2026, 8:09:10 PM
4 viewsavoid.net — verified advice for a post-truth world