Demex’s bridge was exploited through insufficient verification between its bridge module and external-chain contract system. The attacker used a helper contract to falsify token-deployment reports, registering the low-value nLEND token against canonical WETH and WBNB contracts. Subsequent withdrawals released approximately $191,929 in bridge reserves despite deducting only $10.47 worth of nLEND. The withdrawal limiter also failed because it valued the deducted tokens rather than the assets released