# NEM Token Exploit Drains About $821,900 From PancakeSwap Pool

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/38331
Published: 2026-10-22T20:44:06.000Z
Updated: 2026-10-22T20:44:06.000Z
Section: Technology

> The attacker repeated a flawed token-accounting sequence 42 times in PancakeSwap’s USDT/NEM market before selling the remaining NEM for USDT.

An attack on a NEM token contract caused about $821,900 in losses on Oct. 22, stemming from a flaw in how the contract recorded sales.

The affected market was PancakeSwap’s USDT/NEM pair. The defect was in NemTokenV2: it counted tokens transferred into the liquidity pool as sell volume without checking whether a swap had settled. That accounting gap let the attacker repeat the sequence.

The attacker transferred tokens to the pool, called skim() to remove excess tokens and triggered flushLpSellRecycle(). The cycle ran 42 times, consuming NEM reserves already held by the pool while reducing the reserve amounts recorded by the contract. The attacker then sold the remaining NEM at the resulting higher price for USDT.

The attacker address was 0xfd929b0f270dfea6c4827262b4e2bf6ea50fe9b6, and the attack contract was 0x5e6d1f40be466dd2facc94a26818948ecd3b1ca2. The affected trading pair was USDT/NEM on PancakeSwap.