Briefing
On September 7, 2025, Nemo Protocol, a DeFi yield platform operating on the Sui blockchain, was subjected to a sophisticated exploit that resulted in the unauthorized draining of approximately $2.6 million in crypto assets, primarily USDC. The incident stemmed from critical vulnerabilities introduced through unaudited code deployed by a developer, bypassing established security protocols. This compromise allowed an attacker to manipulate internal contract states and siphon funds from the protocol’s liquidity pools, highlighting severe gaps in the platform’s development and governance processes. The total financial impact is estimated at $2.6 million.
Context
Prior to this incident, the prevailing risk landscape in decentralized finance consistently underscored the dangers of unaudited or improperly reviewed smart contracts. The open and immutable nature of DeFi protocols means that any unvetted code can introduce systemic vulnerabilities, creating an expansive attack surface. This exploit leveraged a previously known class of vulnerability → the failure to enforce rigorous code auditing and multi-signature governance for critical contract upgrades, a common vector for integrity compromise in nascent protocols.
Analysis
The incident’s technical mechanics involved the exploitation of two distinct, yet interconnected, vulnerabilities within Nemo Protocol’s smart contract logic. First, an internal flash loan function, intended for restricted use, was inadvertently exposed to the public. Second, a flaw in a query function permitted unauthorized modifications to the contract’s internal state, despite its design for read-only operations.
The attacker capitalized on this combination to manipulate the contract, enabling the illicit borrowing and issuance of tokens, thereby draining assets from the SY/PT liquidity pool. The stolen funds were subsequently bridged from the Sui network to Ethereum via the Wormhole CCTP, complicating immediate recovery efforts.
Parameters
- Protocol Targeted → Nemo Protocol
- Attack Vector → Unaudited Code Deployment, Exposed Flash Loan, State Manipulation
- Financial Impact → $2.6 Million
- Blockchain Affected → Sui (funds bridged to Ethereum)
- Date of Incident → September 7, 2025
- Vulnerability Type → Smart Contract Logic Flaw, Governance Oversight
- Stolen Assets → USDC, other crypto assets
Outlook
In the immediate aftermath, users are advised to disconnect their wallets from Nemo Protocol and monitor official communication channels for updates on remediation and compensation. This event underscores the critical need for all protocols to implement robust, multi-stage auditing processes and enforce stringent multi-signature governance for all code deployments, especially those involving new features or modifications to core logic. The incident will likely catalyze a renewed focus on secure development lifecycle best practices and independent security reviews to mitigate contagion risk across similar DeFi platforms. Nemo Protocol has paused core functions, patched the vulnerabilities, and is pursuing emergency audits, with a compensation plan involving debt tokens for affected users.
