NEM Token Contract Exploit Causes About $821,920 in Losses

An exploit of NEM’s NemTokenV2 contract caused an estimated $821,920 loss after an attacker manipulated the NEM balance in a USDT trading pool and sold tokens into the distorted market.

A transfer-handling flaw in NemTokenV2 let the attacker exploit incomplete swap settlement checks. The attacker ran transfer, skim and flush operations in a loop, repeating the sequence 42 times. Those actions sharply lowered NEM reserves in the PancakePair USDT/NEM pool and updated the pool’s recorded reserve figures.

With the pool reserves reduced and its accounting changed, the attacker sold the remaining NEM at a manipulated higher price and received USDT. The estimated loss was about $821,920.

The incident linked a contract-level transfer flaw with reserve changes in a specific NEM/USDT pool. NemTokenV2 was the affected token contract, and USDT was the asset received in the final exchange. The reported mechanism combined the transfer flaw with changes to that pool’s reserves.