Verify a decision

{"actor":"system:backfill","investigation_id":"22bde892-2ced-429e-a8ca-da3423a18f00","kind":"publish","page_slug":"tendril","published_at":"2026-11-13T20:12:00.691Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"TENDRIL","sections":[{"content":"On November 5, 2026, an attacker drained approximately $550,000 to $555,000 in USDT from the TENDRIL/USDT liquidity pool on PancakeSwap V2 (BNB Chain). Reporting attributes the root cause to a flaw in the token's sell hook, specifically a controlled burn operation tied to a function researchers identified as PoolControl.sellToken. The burn manipulated the pool's token reserves before an external transfer completed, distorting the pricing calculation used by the automated market maker and allowing the attacker to withdraw nearly all of the pool's USDT. One outlet noted an unresolved discrepancy in reported figures: an early estimate from a security monitor put losses at about $309,000, while later figures cited roughly $550,000-$555,000, with the gap attributed to differing methods of counting net loss versus attacker profit. The same report also noted a secondary transfer of 30,000 USDT to what was described as a hardcoded beneficiary address during the exploit, a detail the source said did not fully reconcile with the headline loss figure.","heading":"The Exploit","severity":"critical","sources":[{"credibility":2,"name":"Tendril exploit drains roughly $555K in USDT after sell hook flaw - Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/tendril-exploit-555k-usdt-loss-bnb-chain/"},{"credibility":2,"name":"Tendril sell mechanism flaw leads to $555k in losses - Phemex News","type":"news_article","url":"https://phemex.com/fr/news/article/tendril-sell-mechanism-flaw-leads-to-555k-in-losses-102479"}]},{"content":"Following the exploit, security firms ExVul and ScaleBit issued public alerts identifying the vulnerable TENDRIL token contract, the affected PancakeSwap pair address, and related transaction data. CertiK is reported to have tracked the incident on its Web3 security monitoring dashboard. No post-mortem report from a TENDRIL project team, and no on-chain fund-recovery or law-enforcement action related to this specific incident, could be located at the time of this investigation.","heading":"Security Firm Response","severity":"high","sources":[{"credibility":2,"name":"Tendril sell mechanism flaw leads to $555k in losses - Phemex News","type":"news_article","url":"https://phemex.com/fr/news/article/tendril-sell-mechanism-flaw-leads-to-555k-in-losses-102479"}]},{"content":"A claim circulated that DeFiLlama's hacks tracker tied a portion of the funds stolen in the TENDRIL exploit to wallet addresses also associated with the November 2, 2026 breach of Mercado Bitcoin, Brazil's largest cryptocurrency exchange, which involved an estimated $38-49 million in losses. This investigation was unable to independently verify that specific linkage. A DeFiLlama-sourced passage found during research does describe blockchain investigators tracing stolen funds to addresses associated with the Mercado Bitcoin exploit, but that passage appears in the context of a separate incident and does not mention TENDRIL by name. No source found during this investigation directly confirms address overlap between the TENDRIL exploit and the Mercado Bitcoin breach. This alleged connection should be treated as unconfirmed pending direct review of on-chain address data.","heading":"Alleged Connection to Mercado Bitcoin Breach — Unverified","severity":"medium","sources":[{"credibility":1,"name":"Mercado Bitcoin, Brazil's largest crypto exchange, hit by $46 million security breach - The Block","type":"news_article","url":"https://theblock.co/news/defi/2026-11-02-mercado-bitcoin-hack-46-million-brazil-exchange-432333"},{"credibility":2,"name":"DeFiLlama Hacks Tracker","type":"research","url":"https://defillama.com/hacks"}]},{"content":"For context: Mercado Bitcoin, Brazil's largest cryptocurrency exchange, disclosed a security incident on or around November 2, 2026, with loss estimates ranging from roughly $38 million (per the exchange) to approximately $49 million (per outside trackers) across multiple blockchains. Reporting indicates the breach involved compromised transaction-approval mechanisms rather than a smart-contract bug, with hot wallets and customer deposit addresses emptied. The exchange suspended deposits and withdrawals and stated it would cover customer losses. This is a separate entity from TENDRIL and is referenced here only because of the alleged (unverified) address link described above.","heading":"Mercado Bitcoin Breach (Context, Separate Entity)","severity":"low","sources":[{"credibility":1,"name":"Mercado Bitcoin, Brazil's largest crypto exchange, hit by $46 million security breach - The Block","type":"news_article","url":"https://theblock.co/news/defi/2026-11-02-mercado-bitcoin-hack-46-million-brazil-exchange-432333"},{"credibility":2,"name":"Mercado Bitcoin confirms security incident - CriptoNoticias","type":"news_article","url":"https://www.criptonoticias.com/seguridad-bitcoin/mercado-bitcoin-confirma-incidente-seguridad/"}]}],"sources_used":[{"credibility":2,"name":"Tendril exploit drains roughly $555K in USDT after sell hook flaw - Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/tendril-exploit-555k-usdt-loss-bnb-chain/"},{"credibility":2,"name":"Tendril sell mechanism flaw leads to $555k in losses - Phemex News","type":"news_article","url":"https://phemex.com/fr/news/article/tendril-sell-mechanism-flaw-leads-to-555k-in-losses-102479"},{"credibility":1,"name":"Mercado Bitcoin, Brazil's largest crypto exchange, hit by $46 million security breach - The Block","type":"news_article","url":"https://theblock.co/news/defi/2026-11-02-mercado-bitcoin-hack-46-million-brazil-exchange-432333"},{"credibility":2,"name":"Mercado Bitcoin confirms security incident - CriptoNoticias","type":"news_article","url":"https://www.criptonoticias.com/seguridad-bitcoin/mercado-bitcoin-confirma-incidente-seguridad/"},{"credibility":2,"name":"DeFiLlama Hacks Tracker","type":"research","url":"https://defillama.com/hacks"}],"summary":"On November 5, 2026, an attacker exploited a flaw in the sell logic of the TENDRIL token's PancakeSwap V2 pool on BNB Chain, draining roughly $550,000-$555,000 in USDT. Security firms ExVul and ScaleBit issued public alerts, and CertiK tracked the incident on its security dashboard. A claim that stolen funds were linked to addresses associated with the same-day Mercado Bitcoin exchange breach could not be independently verified from available reporting and is treated here as unconfirmed.","timeline":[{"date":"2026-11-02","date_evidence":"Mercado Bitcoin | Nov 2, 2026 | $40m","event":"Mercado Bitcoin, a Brazilian cryptocurrency exchange, disclosed a security breach involving tens of millions of dollars; this is a separate incident referenced for context on an alleged, unverified fund-tracing claim.","source":"The Block","source_url":"https://theblock.co/news/defi/2026-11-02-mercado-bitcoin-hack-46-million-brazil-exchange-432333"},{"date":"2026-11-05","date_evidence":"The exploit hit the TENDRIL/USDT liquidity pool on PancakeSwap V2 on November 5, 2026.","event":"Attacker exploits a sell-hook/reserve-manipulation flaw in the TENDRIL token's PancakeSwap V2 pool on BNB Chain, draining an estimated $550,000-$555,000 in USDT.","source":"Crypto Briefing","source_url":"https://cryptobriefing.com/tendril-exploit-555k-usdt-loss-bnb-chain/"},{"date":"2026-11","date_original":"2026-11-05","event":"Security firms ExVul and ScaleBit publish alerts identifying the vulnerable TENDRIL contract and affected pool; CertiK tracks the incident on its security dashboard.","source":"Phemex News","source_url":"https://phemex.com/fr/news/article/tendril-sell-mechanism-flaw-leads-to-555k-in-losses-102479"}]},"v":1}