Nemo Yield Trading Hack

What happened

On September 7, 2025, Nemo Protocol on Sui lost about $2.6 million after unaudited code introduced two exploitable flaws: an internal flash-loan function was publicly callable, and a query function could change contract state. The attacker combined the flaws to manipulate internal state and drain substantial assets from the SY/PT liquidity pool before funds were bridged to Ethereum.

How it happened

1. Features added after audit review were deployed without being submitted for review.
2. An internal flash-loan function was publicly callable, while a query function could modify state.
3. The attacker combined those flaws to manipulate internal state and drain the SY/PT liquidity pool.
4. Nemo paused core functions, patched the flaws, and submitted updated code for emergency review.

Protocol details

Classification Protocol Logic / Access Control

Protocol Type Yield

Implementation language Move

Protocol links Website @nemoprotocol

Market Context at Time of Hack

Token Price at Hack $0.00026886

Security review history

• MoveBit View report

Evidence

• report @CertiKAlert incident report x.com
• report Nemo Protocol Audit Report movebit.xyz
• analysis Website reference theblock.co
• analysis Website reference coindesk.com
• analysis DeFiLlama defillama.com
• analysis Nemo Protocol says unaudited code deployment led to $2.6 million exploit theblock.co

Understand the attack patterns

Compare incidents →

Access Control Attacks Flash Loan Attacks Oracle Manipulation & Price Manipulation