Incident Overview
On September 8, 2025, Nemo Protocol, a Sui-based yield infrastructure and trading platform, was exploited for approximately $2.4 million in USDC stablecoins. The attacker subsequently bridged the stolen funds from Arbitrum to Ethereum, prompting Nemo to suspend all smart contract activity and investigate the security incident affecting their Market pool.
The attack targeted Nemo Protocol's lending infrastructure through what appears to be price manipulation techniques, resulting in the theft of $2.4 million in USDC from the platform's Market pool. Following the exploit, the attacker moved the stolen USDC tokens from Arbitrum to Ethereum via cross-chain bridges to obscure the transaction trail. Nemo Protocol responded by immediately suspending all smart contract activity while conducting an investigation into the root cause of the breach.
The platform confirmed that all vault assets remain secure despite the Market pool compromise. The exploit caused significant damage to the protocol's total value locked (TVL), which plummeted from over $6 million to $1.53 million according to DeFiLlama data. Nemo had previously announced scheduled maintenance for Monday and Tuesday, though the timing relationship to the exploit remains unclear.
The team has not yet publicly identified the specific vulnerability that enabled the attack.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Nemo, these are the critical security checks that could have prevented this incident (September 2025).
- Verify all logic paths related to Oracle Issue are guarded by proper access controls and input validation - see the Oracle Manipulation & Price Manipulation attack class for patterns
- Audit oracle price feeds for manipulation risks - ensure time-weighted average prices (TWAPs) or multi-source aggregators are used, not spot prices
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next Nemo
The Nemo hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.