# Security Roundup: TENDRIL Pool Drained Through a Sell-Triggered Burn, Unifund Counted a WETH Round Trip as Profit

DeFiHackLabs' incident log reached 909 entries overnight, and SafePal customers whose data leaked in August are now getting fake security letters in the post.

- Published: 2026-11-13T05:45:42.603Z
- Canonical: https://polylog.news/crypto/2026-11-13/security-roundup-tendril-pool-drained-through-a-sell-trigger
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [DeFiHackLabs (TENDRIL PoC)](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/95d1759c801f52e7229d13ab595841c2a1258e9d), [DeFiHackLabs (TENDRIL count)](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/17a785f60d4501aef0ca0d9ee657d0893f065946), [DeFiHackLabs (TENDRIL merge)](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/88275f71e505b4e0e5953dc098092cef5f673132), [DeFiHackLabs (Unifund PoC)](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/e6a9d80a61a88672acb5c2ce979522ed79246ea0), [DeFiHackLabs (Unifund count)](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/8692782383701e364fe561c93d0c4e9eacb661f1), [DeFiHackLabs (EtherVista PoC)](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/df91bc6ce1c5b505dcfd4f1cb958eadf59a85eae), [Polylog editors](https://polylog.news), [Crypto Briefing](https://cryptobriefing.com/tendril-exploit-555k-usdt-loss-bnb-chain/), [DeFiHackLabs pull request 1323](https://github.com/SunWeb3Sec/DeFiHackLabs/pull/1323), [eSecurity Planet](https://esecurityplanet.com/cybersecurity-threats/news-safepal-data-breach-40000-customers)

TENDRIL (BNB Chain, November 4). DeFiHackLabs added a proof of concept for the TENDRIL token, which it classifies as a transfer-tax auto-liquidation exploit. The token's sell hook burned TENDRIL directly out of its PancakeSwap V2 pool. Repe…

This story is for subscribers. Read it in full at https://polylog.news/crypto/2026-11-13/security-roundup-tendril-pool-drained-through-a-sell-trigger (subscription information: https://polylog.news/pricing).