On April 4, 2026, attacker used flashloans to burn ~850M TMM tokens, reducing the TMM reserve to 1 token in the TMM/USDT pool. This price distortion allowed swapping for 272M USDT, netting $1.665M profit after flashloan repayment. Inadequate access controls enabled the large-scale burn.

According to ExVul monitoring, a TMM/USDT reserve manipulation attack occurred on the BSC (BNB Chain), resulting in a loss of approximately 1.665 million USDT. The attacker utilized flash loans from Lista DAO Moolah, Venus, Aave V3, PancakeSwap Vault, and Uniswap PoolManager to manipulate the TMM/USDT trading pair. By burning TMM to a dead address, the attacker reduced the pair's reserve to just 1 TMM, subsequently swapping 850 million TMM for approximately 272 million USDT. After repaying all flash loans, the attacker transferred a net profit of roughly 1.665 million USDT to associated addresses.