CertiK flags $820K exploit draining NEM token's PancakeSwap liquidity pool
In brief
- CertiK Alert estimated losses from the NEM token exploit at approximately $820,000.
- SlowMist corroborated the findings and put the damage at about $821,920.
- NemTokenV2 contract on BNB Chain had a logic flaw that counted any pool transfer as a sell.
- SlowMist said the attacker ran the loop 42 times, then bridged funds to Ethereum.
- Crypto Briefing's report includes no statement from the NEM team.
How the NemTokenV2 flaw worked
The vulnerable code lived in a contract called NemTokenV2 on BNB Chain. At its center was a mechanism named 'pendingLpSellRecycle', which was built to track and process sells flowing into the liquidity pool. So what went wrong? It treated any transfer of tokens into the liquidity pair as sell volume and never checked whether a real sale had actually happened.
That was the opening.
PancakeSwap pools keep an internal record of reserves, and when the actual token balance in a pool climbs above that recorded figure, the surplus can be withdrawn. According to SlowMist's analysis (as reported by Crypto Briefing), the attacker kept sending NEM tokens into the pool, skimmed the excess back out, and ran the loop 42 times. SlowMist said each round distorted the pool's reserves and artificially pushed up the token's price. Once enough value had been pulled out, the attacker extracted it and bridged the stolen funds to Ethereum.
Who absorbs the losses
Liquidity providers in the drained pool absorbed the losses. Crypto Briefing's report doesn't include a statement from the NEM team, and it doesn't say that any funds have been recovered.
The timing also works against victims. CertiK and SlowMist often publish incident breakdowns within hours, though funds have typically moved by the time an alert goes out.
A pattern on BNB Chain
Crypto Briefing's cited findings describe a recurring 2026 trend in which BNB Chain tokens with complex tokenomics have proved vulnerable to reserve manipulation. According to the same report, Movie Token, ATM and LULA (all projects with similar mechanics) suffered comparable attacks earlier this year.
The outlet's analysis argues that audits need to test how custom token logic interacts with exchange pools instead of reviewing token contracts in isolation. By Crypto Briefing's reading, that's the gap the NEM attacker exploited: a contract that may have looked fine on its own but broke once it was paired with a PancakeSwap pool's reserve accounting.
Frequently asked questions
How did the NEM token exploit on PancakeSwap work?
The NemTokenV2 contract treated any token transfer into the liquidity pair as sell volume without checking whether a real sale had happened. According to SlowMist, the attacker repeatedly sent NEM into the PancakeSwap pool and skimmed the surplus over recorded reserves back out, repeating the loop 42 times.
How much was lost in the NEM token exploit?
CertiK Alert estimated losses at approximately $820,000. SlowMist corroborated the findings and put the damage at about $821,920. Both figures are estimates, and the stolen funds were bridged to Ethereum, according to SlowMist's analysis as reported by Crypto Briefing.
Who bears the losses when a liquidity pool is drained?
In the NEM case, liquidity providers in the drained USDT/NEM pool absorbed the losses, according to Crypto Briefing. The report doesn't include a statement from the NEM team and doesn't say any funds were recovered.
