Web3 Daily Exploits — 5 Nov 2026: TENDRIL ~$555K Sell-Hook Drain on BNB

The 5 Nov America/Panama window records one first-reported protocol incident used for scoring. TENDRIL, a Flap-style fee-on-transfer tax token on BNB Chain, lost approximately 555,000 USDT from its PancakeSwap V2 TENDRIL/USDT pair after an attacker exploited the token’s sell-hook logic. The vulnerability allowed a controlburn path to debit the pair’s token balance and call pair.sync() before the remaining outer transfer arrived, collapsing reserves and enabling the attacker to withdraw nearly the entire USDT side. CertiKAlert and DefimonAlerts both reported a net loss near $555K; earlier monitoring had cited lower figures around $309K before full accounting. No official project statement was located at cutoff. Separately, the prior CoreVault BNB Chain oracle flash-loan (~$112K net) and Mercado Bitcoin multi-chain signing incident remain UPDATEs with no material new scored loss. Combined live loss on this card is ~$555K for the newly scored TENDRIL item.

TENDRIL — BNB Chain — ~$555K — sell-hook reserve desync / tax-token auto-liquidation

What happened: On or around 4–5 November 2026 UTC, an attacker deployed a fresh contract funded via Tornado Cash and flash-borrowed a large USDT amount (reports cite ~30.6M USDT from PancakeSwap Infinity Vault). The contract repeatedly executed swapExactTokensForTokensSupportingFeeOnTransferTokens against the thin TENDRIL/USDT PancakeSwap V2 pair (0x5de082471f2a9f01a61e467a32837dee830d99e0). TENDRIL applies a 30% tax on transfers and, on taxed sells, invokes PoolControl.sellToken which calls a restricted controlburn on the pair itself followed by pair.sync(). Because the burn and sync occurred before the outer 70% transfer completed, the synchronized token reserve was driven extremely low (reports cite 6,678 wei). The delayed outer swap then extracted nearly all USDT from the pair. The attacker repaid the flash loan in the same transaction and swept profit to beneficiary addresses. DefimonAlerts described it as flash-loan / spot-price manipulation via fee-on-transfer tax-token auto-liquidation; ExVul and CertiK framed it as a sell-hook that lets sellers debit pair balances and sync reserves prematurely.

Protocol / chain / asset: TENDRIL token (0xb1afdfd850da168f2cc9f742e11cdda5273973d2) and its PancakeSwap V2 USDT pair on BNB Chain (BSC). Asset: USDT (Binance-Peg). The token is described as a Flap-style tax token.

Loss: CertiKAlert reported ~$555K net loss. DefimonAlerts put the TENDRIL/USDT pool loss at ~555K USDT (~$555K), with attacker payout addresses receiving ~$541K. ExVul noted the pool lost 550k USDT and that final profit after observed purchases, gas and a 30K USDT hardcoded beneficiary payment was at most ~181,910 USDT before unpriced LP basis. Early TenArmorAlert figures were lower (~$309K). Live scored figure used here is ~$555K (consensus net / pool drain). Most extracted USDT remained with attacker-controlled addresses at reporting time.

Attack type: Custom sell-hook / fee-on-transfer logic vulnerability that desynchronizes Uniswap V2-style pair reserves via premature burn + sync before the outer transfer completes. Combined with flash-loan capital and thin liquidity. Classic hook-ordering / reserve-manipulation pattern previously observed on other BSC tax tokens.

Explorer URLs: Attack transaction: https://bscscan.com/tx/0xfdff4fba4327821c204af07944076ecaaee163a994398fdf4063d08712e40059. Exploit contract: https://bscscan.com/address/0xc8cb6a2aa825a576e1470479046056fe414ee0f8. Profit beneficiary: https://bscscan.com/address/0xb87cf5ab84d0ab9545358cd30229627305331373. Victim pair: https://bscscan.com/address/0x5de082471f2a9f01a61e467a32837dee830d99e0. TENDRIL token: https://bscscan.com/address/0xb1afdfd850da168f2cc9f742e11cdda5273973d2. Operator / deployer: https://bscscan.com/address/0xb81e4aafa347b27112b7f6f5de6cf7cd516021ff.

Status: Confirmed by CertiKAlert, DefimonAlerts and independent researchers (ExVul). No official project statement, pause announcement or recovery plan located at cutoff. Treat as confirmed drain of the reported USDT amount from the PancakeSwap V2 pair. Flag any subsequent protocol communication as material update. Similar burn-then-sync patterns have appeared on other BSC tokens (YSDAO, AIDC, SKYDAO).

Sources: DefimonAlerts: https://x.com/DefimonAlerts/status/2118229071972684057; CertiKAlert: https://x.com/CertiKAlert/status/2118242639212658985; ExVul: https://x.com/exvulsec/status/2118221337617383455; CryptoBriefing coverage.

Also noted

• CoreVault / BNIX / OSK InsurancePool (UPDATE, not re-scored): Incident first reported 3–4 November. Flash-loan oracle manipulation inflated redemptions and depleted ~160 BNB net (~$112K) from the InsurancePool on BNB Chain. No material new loss figures or official postmortem in the last 24 hours. Prior coverage: https://www.rektradar.xyz/web3-daily-exploits-04-nov-2026-corevault-112k-oracle-flash/.
• Mercado Bitcoin multi-chain signing drain (UPDATE, not re-scored): Incident first reported 2 November. Exchange previously stated affected assets ~$36.3M with ~$12.9M blocked/frozen and gradual reopening plans; customers covered. No material new loss figures used for scoring today. Prior coverage: https://www.rektradar.xyz/web3-daily-exploits-03-nov-2026-mercado-46m-signing-drain/.
• Binance hot-wallet signing-access compromise (UPDATE, not re-scored): The ~$6.3 billion multi-chain drain from 29 October remains on prior briefs. No material new scored loss figures in the last 24 hours. Prior coverage: https://www.rektradar.xyz/web3-daily-exploits-30-oct-2026-binance-63b-eip7702-polymarket-debugbear/.
• Prior items (not re-scored): PremiaLabs, Troves, b14g, BTCPay Server older-version sweeps and earlier incidents remain as previously briefed. No material new loss figures used for scoring.
• Monitored accounts: DefimonAlerts, CertiKAlert, Phalcon_xyz, GoPlusSecurity, SlowMist_Team, PeckShieldAlert, BlockSecTeam, Lookonchain, ZachXBT, CyversAlerts, Immunefi and rekt.news. No additional first-report protocol or smart-contract drains with fresh scored loss figures beyond the TENDRIL item. Scattered white-hat return messages and unrelated market movements were noted but not scored.

Sources and references

• DefimonAlerts TENDRIL: https://x.com/DefimonAlerts/status/2118229071972684057
• CertiKAlert TENDRIL: https://x.com/CertiKAlert/status/2118242639212658985
• ExVul detailed analysis: https://x.com/exvulsec/status/2118221337617383455
• CryptoBriefing: https://cryptobriefing.com/tendril-exploit-555k-usdt-loss-bnb-chain/
• 4 Nov brief for CoreVault: https://www.rektradar.xyz/web3-daily-exploits-04-nov-2026-corevault-112k-oracle-flash/
• 3 Nov brief for Mercado Bitcoin: https://www.rektradar.xyz/web3-daily-exploits-03-nov-2026-mercado-46m-signing-drain/
• Monitored accounts checked: DefimonAlerts, CertiKAlert, Phalcon_xyz, GoPlusSecurity, SlowMist_Team, PeckShieldAlert, BlockSecTeam, Lookonchain, ZachXBT, CyversAlerts, Immunefi, rekt.news. No additional first-report protocol exploits with fresh scored loss figures in the last 24 hours.

Editor’s note: the scored live loss on this card is ~$555K. The newly reported item is the TENDRIL BNB Chain sell-hook reserve desync against the PancakeSwap V2 pair. CoreVault and Mercado Bitcoin are UPDATEs. Binance remains an UPDATE. No how-to or exploit reproduction steps. Stay tuned or stay rekt.