NEM token exploit drains $821,900 from PancakeSwap liquidity pool

On October 22, 2026, an attacker exploited an accounting flaw in the NemTokenV2 smart contract, draining over $820,000 from PancakeSwap's USDT/NEM liquidity pool. Security firms CertiK and SlowMist reported that the contract incorrectly counted token transfers as sell volume without checking for actual swaps. By looping this operation 42 times, the attacker manipulated reserves, artificially inflated the token price, and bridged stolen funds to Ethereum. The incident follows similar 2026 attacks on BNB Chain projects.

Exploit detection and total loss

• ▪An exploit targeting the NEM token contract drained approximately $820,000 to $821,920 from PancakeSwap's USDT/NEM liquidity pool on October 22, 2026.
• ▪Blockchain security firms CertiK Alert and SlowMist flagged the NEM token exploit, with SlowMist specifying total damage at about $821,920.

NemTokenV2 smart contract vulnerability

• ▪The NemTokenV2 contract contained an accounting flaw that treated any token transfer into the liquidity pool as sell volume without verifying if a real sale or swap had settled.
• ▪The vulnerability was identified in the NemTokenV2 smart contract within a logic mechanism named pendingLpSellRecycle.

Attacker actions and exploit execution

• ▪The NEM token attack distorted liquidity pool reserves, artificially pushed up the token price, and allowed the attacker to sell remaining NEM at the inflated price for USDT.
• ▪The attacker repeated an exploit loop 42 times by sending NEM tokens to the pool, calling skim() to extract excess tokens, and triggering flushLpSellRecycle().
• ▪The NEM token exploit was carried out using attacker address 0xfd929b0f270dfea6c4827262b4e2bf6ea50fe9b6 and attack contract 0x5e6d1f40be466dd2facc94a26818948ecd3b1ca2.
• ▪The attacker extracted the funds pulled from PancakeSwap's liquidity pool and bridged the stolen funds over to Ethereum.

Wider BNB Chain token vulnerabilities

• ▪Earlier in 2026, BNB Chain projects with complex tokenomics including Movie Token, ATM, and LULA suffered attacks similar to the NEM token exploit.
• ▪BNB Chain tokens that add custom logic into interactions with PancakeSwap pools created vulnerabilities in 2026 by maintaining parallel accounting against standard decentralized exchange reserves.