Nemo Protocol explained the reasons for the $2,6 million hack

Key points:

• Nemo Protocol reported two vulnerabilities that were introduced into the code base without being checked by the developer.
• The team is working with Sui’s security departments and developing a compensation plan for those affected.
• The damage from the exploit amounted to $2,6 million.

The Sui-based DeFi platform Nemo Protocol said that the $2,6 million exploit was the result of two vulnerabilities introduced into the code base without proper review by the developer.

In its report, Nemo explained that the September 7 attack was caused by two issues: an internal flash loan function that was mistakenly made public, and an error in the query function that allowed unauthorized changes to the contract state.

Overview of the largest NPM attack in history: what it is and how it relates to crypto

Malicious code was embedded in specialized packages for developers that are used to create global Internet infrastructure

Read more

According to analysts, the vulnerabilities appeared as early as January 2025. Following an audit by MoveBit, which specializes in blockchain security, one of Nemo’s developers added new features to the code base without verification. The version of the contract containing this code was then deployed to the mainnet. The experts added:

“The governance root cause was the protocol’s reliance on a single-signature address for upgrades, which failed to prevent the deployment of code that had not undergone rigorous scrutiny.”

The development team did not respond to a warning from the Asymptotic security team received in August regarding another, but related vulnerability.

How did the hackers operate?

The attacker used a combination of flash loan and state-modifying query functions to manipulate the internal state of the contract, removing assets from the SY/PT liquidity pool. The stolen funds were transferred from the Sui network to Ethereum via Wormhole CCTP, with most of the assets currently stored at a single address.

Nemo Protocol has suspended its core functions, fixed the vulnerabilities, and sent the updated code for an emergency audit. The team is working with Sui security services to track the assets and is preparing a compensation plan for affected users.

Nemo Protocol is a Sui-based yield and trading platform. It focuses on tokenizing yields, allowing users to trade, hedge, or leverage yields more effectively.