blockintAI · Research blog

TENDRIL Exploit on BNB Chain: A Tornado Cash-Funded Wallet, a Week of Setup, and 309K USDT Still Parked a Day Later

BlockintAI · 2026-11-05T15:21:39.993Z

At 10:02:45 AM CT on Wednesday, November 4, 2026, an attacker drained the TENDRIL/USDT pool on PancakeSwap on BNB Chain. CertiK Alert reports that TENDRIL's "sell hook let sellers debit pair's token balance and sync reserves before remaining sell input arrived. The delayed input then withdrew near all USDT, causing ~$555K net loss."

BlockintAI read the attack transaction and the history of the wallet that received the profit, to see how the attack was set up and where the money is now.

Times are US Central Time (CST, UTC-6).

Key facts
When Nov 4, 2026, 10:02:45 AM CT (16:02:45 UTC), BNB Chain block 131,653,427
What A sell-tax hook in the TENDRIL token burned the pool's TENDRIL and re-synced its reserves before the seller's tokens arrived (CertiK, BlockSec Phalcon, ExVul)
Pool loss 555,670.54 USDT net out of the TENDRIL/USDT pair in the attack transaction, BlockintAI's read; CertiK reports ~$555K, Phalcon ~$556K
Flash loan 30,641,402.47 USDT borrowed from a contract named Vault and repaid in the same transaction
Profit wallet Received 308,959.37 USDT at the end of the attack transaction
Funding Seven withdrawals from Tornado Cash BNB pools (24.96 BNB in total), Oct 27 to Nov 4, plus BNB and USDT from one other wallet
Where it is now 309,111.24 USDT still in the profit wallet at 7:19 AM CT Nov 5

On-chain figures come from public BNB Chain node reads and the Etherscan multichain API for BNB Chain. Contract names are the names in each contract's verified source code.

How the attack worked

TENDRIL charges a tax when someone sells. BlockSec Phalcon reports that a sale "triggered the token's 30% tax and a call to its tax-handling contract", which sold the tax tokens, then called controlburn() and sync() and cut the pool's recorded TENDRIL reserve "to nearly zero". The seller's remaining tokens then reached the pool, and the swap that followed took "virtually the entire remaining 4.42M USDT reserve". ExVul says the burn left the pool's synchronized TENDRIL reserve at 6,678 wei, and that anyone selling could trigger the whole chain of calls.

In the attack transaction, the USDT moved like this:

  1. 30,641,402.47 USDT came in from the contract named Vault (0x238a358808379702088667322f80ac48bad5e6c4) and went back to it at the end of the transaction.
  2. The TENDRIL/USDT pair, 0x5de082471f2a9f01a61e467a32837dee830d99e0 (verified name PancakePair), paid out 5,117,517.82 USDT and took in 4,561,847.29 USDT. That's a net 555,670.54 USDT out of the pool.
  3. The exploit contract's last transfer sent 308,959.37 USDT to the profit wallet, 0xb87cf5ab…1373. Phalcon gives the same figure, about 308.96K USDT.

ExVul puts the attacker's campaign profit at "at most ~181,910.34 USDT after directly observed token purchases and gas".

Before the attack: funding and a week of setup

The profit wallet, 0xb87cf5ab…1373, first appeared on October 27, eight days before the attack.

  • Tornado Cash. It received seven withdrawals from two Tornado Cash pool contracts on BNB Chain (verified name ETHTornado): two of 9.99 BNB from 0x330bdfade01ee9bf63c209ee33102dd334618e0a, at 3:55 AM CT on October 27 and 2:24 AM CT on October 29, and five of about 0.997 BNB from 0xd47438c816c9e7f2e2888e060936a499af9582b3, three on October 30 and two on the morning of November 4. That's 24.96 BNB in total, amounts consistent with 10 BNB and 1 BNB notes after relayer fees.
  • One more funder. The wallet's first transaction, at 3:47 AM CT on October 27, was 3.10 BNB from another wallet, 0xf70da978…dbef. That wallet sent it 2,244.23, 4,506.65, 2,274.28 and 2,301.50 USDT between November 1 and November 4.
  • The position. The wallet swapped its BNB into USDT. Between October 27 and November 4, through dozens of transactions with a PancakeSwap V3 pool and an unverified contract, it built up 33,062,475,439.77 TENDRIL.
  • The operator wallet. At 9:04 AM CT on November 4, the profit wallet sent 0.00046 BNB for gas to 0xb81e4aaf…21ff. That wallet deployed two contracts, at 9:41 and 9:45 AM CT. The second, 0xc8cb6a2a…e0f8, is the exploit contract. ExVul names 0xb81e4aaf…21ff as the operator and exploit deployer.
  • One minute before. At 10:01:38 AM CT the profit wallet moved all 33.06 billion TENDRIL to the exploit contract. The operator wallet called the exploit contract 67 seconds later.

After the attack: still parked

The 308,959.37 USDT landed at 10:02:45 AM CT. At 7:19 AM CT on November 5, the profit wallet held 309,111.24 USDT and 0.008 BNB. In the 21 hours since the attack, it has made no outgoing transaction. A security researcher, sprunky_eth, also noted the "~309K USDT still sitting" there.

The USDT on BNB Chain is the Binance-Peg token, BSC-USD (0x55d398326f99059ff775485246999027b3197955).

What this shows

  • Tornado in, then a week of patience. The attacker took BNB out of Tornado Cash, set up the position over a week, and moved it to the exploit contract one minute before the attack.
  • Tax tokens are a repeat target. sprunky_eth writes that the same burn-then-sync technique was used against YSDAO in May, AIDC in June and SKYDAO in September. Any token that burns from, or re-syncs, its own pair inside a transfer hook should be checked for this.
  • The money hasn't moved yet. A day later, the profit is still in one wallet.

If you hold a token that charges a sell tax, check whether its tax contract can touch the trading pair's balance during a sale.

Addresses in this post

Shortened because they are not yet in a BlockintAI report:

  • 0xb87cf5ab…1373 (profit wallet; named by ExVul as attacker / profit beneficiary)
  • 0xb81e4aaf…21ff (operator / exploit deployer, per ExVul)
  • 0xc8cb6a2a…e0f8 (exploit contract)
  • 0xf70da978…dbef (sent the profit wallet 3.10 BNB and USDT)

Contracts:

  • 0x5de082471f2a9f01a61e467a32837dee830d99e0 (TENDRIL/USDT PancakePair, the drained pool)
  • 0xb1afdfd850da168f2cc9f742e11cdda5273973d2 (TENDRIL token)
  • 0x238a358808379702088667322f80ac48bad5e6c4 (Vault, flash-loan source)
  • 0x330bdfade01ee9bf63c209ee33102dd334618e0a and 0xd47438c816c9e7f2e2888e060936a499af9582b3 (Tornado Cash BNB Chain pools)

Sources

Lost money? Report it to IC3 (FBI) at ic3.gov and the FTC at reportfraud.ftc.gov, and file at https://blockint.ai/c3?mode=file