Tendril exploit drains roughly $555K in USDT after sell hook flaw

TENDRIL is a DeFi project running on BNB Chain, and the incident centers on a flaw in its sell logic. A security advisory from 0xCERT put the event in the context of a sell-hook vulnerability, which is the kind of custom token behavior that can sit inside DeFi systems. This matters because token contracts often automate trading rules, and errors in those rules can become an immediate security issue for liquidity pools and users.

Users and builders on BNB Chain have to treat custom token logic as something that needs close review before it is put into circulation. A pool tied to TENDRIL and USDT was the one named in the advisory, so the practical concern is not abstract code quality but money moving out of a live pool. Projects that rely on bespoke sell rules may need to change how they test and audit those rules before deployment.

The tension here is between flexible DeFi design and the safety of the contracts that enforce it. Hooks and custom sell logic can give tokens more control over how they behave, but they also expand the attack surface when the code is wrong or incomplete. That trade-off is visible in this case because the issue was not market behavior or user error, but a weakness in token logic itself.

Still unclear is the exact path the exploit took through TENDRIL’s code and whether any wider parts of the project were affected beyond the TENDRIL/USDT pool. The advisory names the loss and the flaw, but it does not settle whether similar logic exists elsewhere in the system or whether related contracts need changes. A fuller technical postmortem or audit report would be needed to show how the sell-hook issue was handled after the incident.

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.