NEM exploit drains $822K from PancakeSwap pair on BNB Chain

On October 21, 2026, an attacker drained about $822K from the PancakeSwap USDT/NEM pair by abusing NEM's sell-recycle burn feature. Transfers into the pool inflated a sell counter that survived skim() withdrawals, letting flushLpSellRecycle() burn LP-owned NEM and distort the price.

• Pool lost 821,920 USDT; attacker netted 726,307 USDT
• Attack looped transfer-skim-flush 42 times in one transaction
• Flash loans of 235.8M USDT came from 21 sources
• Root cause: transfers to the pair counted as sells without swap verification