NEM exploit drains about $820,000 from PancakeSwap USDT/NEM pool

A security alert from 0xCERT says the NEM token was hit by an exploit that drained roughly $820,000 from a PancakeSwap USDT/NEM liquidity pool. The advisory points to a flaw in the NemTokenV2 contract’s sell-tracking logic, which appears to have been used to manipulate pool reserves and extract value from the pair.

CertiK also flagged the incident in an alert on X, describing the drain as tied to a faulty mechanism that left pendingLpSellRecycle active after tokens were moved out of the pool via skim(). According to that alert, the contract then treated those movements as sell activity, which allowed the attacker to burn NEM reserves and distort the token’s price on PancakeSwap.

How the pool was manipulated

The details provided in the advisory and security alerts indicate that the exploit centered on the way the token contract interpreted transfers into the liquidity pair. Instead of reliably distinguishing a real sale from a token movement into the pool, the logic appears to have treated some transfers as sell volume.

That mismatch created room for repeated reserve adjustments. The alert says the attacker was able to run the exploit multiple times, draining value from the pool before the remaining tokens were sold. The reported mechanism matches the broad picture of a reserve-manipulation attack rather than a simple wallet compromise.

SlowMist was also referenced in secondary coverage of the incident, with estimates placing losses in the same range. The available evidence points to the PancakeSwap USDT/NEM pair on BNB Chain as the affected market.

At this stage, the main confirmed detail is the loss estimate and the exploit path described by the security alerts. The incident underscores a familiar DeFi risk: custom token logic can interact badly with automated market-making pools when contract accounting does not match actual trade behavior.