NEM Token Suffers $820,000 Exploit on BNB Chain

On October 22, 2026, CertiK Alert identified an exploit targeting the NEM token on the BNB Chain. The incident resulted in losses estimated at approximately $820,000, with SlowMist reporting the damage at $821,920.

The vulnerability originated in the NemTokenV2 smart contract, specifically within the pendingLpSellRecycle mechanism. This function incorrectly identified any token transfer into the USDT/NEM liquidity pool on PancakeSwap as a sale, allowing the attacker to manipulate reserve records.

The attacker executed the exploit 42 times, repeatedly sending tokens to the pool to create a surplus and then withdrawing the excess funds. Following the theft, the assets were bridged to the Ethereum network.

This incident follows a series of similar attacks in 2026 targeting BNB Chain projects with complex tokenomics, including Movie Token, ATM, and LULA. Security researchers note that these vulnerabilities often arise when custom contract logic interacts with decentralized exchange pools.