Tendril exploit drains roughly $555K in USDT after sell hook flaw

An attacker abused a bug in the TENDRIL token's sell logic to pull nearly all USDT from its PancakeSwap V2 pool on BNB Chain A small token on BNB Chain just learned an expensive lesson about custom code. A flaw in TENDRIL’s sell hook let an attacker withdraw nearly all of the USDT backing the token, producing a net loss of about $555,000. The exploit hit the TENDRIL/USDT liquidity pool on PancakeSwap V2 on November 5, 2026. The weak point was the token’s sell logic. Many tokens on BNB Chain add custom behavior that fires whenever someone sells, such as fees, burns or reserve adjustments. That extra code is usually called a hook. Security researchers traced the attack to function calls including PoolControl.sellToken, paired with a controlled burn operation.