TENDRIL sell mechanism vulnerability causes about $555,000 n
On November 5, 2026, CertiK Alert disclosed a vulnerability in TENDRIL's Sell Hook mechanism: the seller could deduct the trading pair's token balance and synchronize reserves before the remaining sell input arrived, and the input that arrived later then withdrew almost all USDT, causing a net loss of approximately $555,000. Both PANews and Odaily 星球日报 cited the same monitoring conclusion.
Event Timeline
- [11-05 07:26] TENDRIL sell mechanism vulnerability has caused a loss of approximately $555,000 (PANews)
- [11-05 07:28] Net loss of approximately $555,000; TENDRIL sell mechanism vulnerability has caused losses (Odaily 星球日报)
Background and Impact
On November 5, 2026, CertiK Alert posted on X that TENDRIL's Sell Hook mechanism had a problem and had caused a net loss of approximately $555,000. PANews reported the news at 07:26 that day, and Odaily 星球日报 at 07:28. Both sources cited CertiK Alert's monitoring conclusion and were consistent in the loss amount and the description of the vulnerability.
According to CertiK Alert's description, the vulnerability worked as follows: the Sell Hook allowed the seller to deduct the trading pair's token balance and synchronize reserves before the remaining sell input arrived; the input that arrived later then withdrew almost all USDT, resulting in the aforementioned net loss of approximately $555,000. The two outlets described this mechanism in basically the same way, but neither further disclosed the specific distribution of the affected funds, the specific time the vulnerability was discovered, or whether any remediation actions had been taken.
Based on currently available public information, there is no discrepancy in figures or conclusions between the two sources; both use the wording "approximately $555,000 net loss." It should be noted that both reports come from the same monitoring source, CertiK Alert, and the material contains no statement from the TENDRIL project team or any other independent third party. The full picture of the incident, the final determination of losses, and subsequent handling still await further disclosure. In terms of risk implications, this problem occurred in the synchronization of the trading pair's balance and reserves, rather than merely in token contract permissions. For traders concerned about on-chain risk, before participating in trading new tokens it is usually necessary to check the contract and platform announcements themselves. Some users also obtain clients and risk disclosures through official entry points such as Huobi HTX registration APP download, Zhima Gate.io registration APP download, Bitget registration APP download, Binance registration APP download, and OKX registration APP download, using them as one source of information for cross-checking.
As of the publication of the two reports, the reports did not mention whether TENDRIL suspended the relevant trading pair, whether compensation was arranged, or whether a security team had further intervened. The material contains no information on whether the funds can be recovered or whether the scale of losses will continue to expand.
FAQ
### How large was the loss caused by this vulnerability, and which asset was involved?
According to CertiK Alert monitoring, the net loss was approximately $555,000, and the USDT in the trading pair was withdrawn by the input that arrived later. Neither source disclosed other affected assets or details of the fund distribution.
### What public milestones are worth watching going forward?
At the time the two reports were published, neither mentioned a response from the TENDRIL project team, whether the relevant trading pair was suspended, or whether compensation or fund recovery was arranged. These statements and the progress of handling are information points that can be observed going forward.
### What can ordinary users note from this incident?
The material itself does not provide advice. What can be observed is that the problem occurred in the synchronization of the trading pair's balance and reserves. Checking contract information and reviewing platform announcements before trading is a common risk