Suspected TENDRIL/USDT pool attack: reported loss near $309,000

What the $309,000 figure measures

The amount is the reported loss associated with the suspicious pool attack. Keep “about” attached to it. Neither opened report provides a transaction-by-transaction accounting, an affected-user list or a final recovery total. Dividing the figure among holders would invent information about who lost money.

The wording also matters for USDT holders. A report naming TENDRIL/USDT does not establish an incident affecting every wallet holding USDT. The pair label identifies the reported pool. It gives no basis for treating an unrelated exchange balance, another pool or a different network as affected.

For someone seeing the headline while trading, the useful question is whether their own activity involved the reported pool. Start with the wallet and transaction records you already have. Match the network, token contract and interaction address. A ticker match alone cannot complete that check, and the reports opened for this article do not supply an address we can reproduce as verified.

We have not verified an exploit mechanism, the attacker's identity, a project response or compensation terms. We also have no sourced basis for saying the incident is contained. Those gaps affect what readers should sign: a message promising recovery needs its own verification and cannot borrow authority from this loss estimate.

Review approvals separately from connections

MetaMask's official help page distinguishes connecting a wallet to an application from granting a token allowance to a smart contract. It explains that token approvals can permit the contract to move tokens for the requested operation. That distinction is useful when checking past interactions after a pool alert. Closing a browser tab does not answer which permissions remain.

The same guide treats disconnecting an application and revoking an approval as different actions. Review the allowance itself rather than assuming that removing a connected site has completed the job. MetaMask explains approvals and revocation.

MetaMask lists BNB Chain among the networks supported by its Portfolio allowance-review feature. The guide also describes approval checkers on block explorers. Use a route you can verify through the wallet's official help page; do not choose a checker from a reply promising to return lost funds.

Revocation is an on-chain transaction and requires gas, according to MetaMask. Before confirming one, inspect the network, token and spending contract shown in the request. This is a permission review, not a verified remedy for the TENDRIL incident. The available reporting does not establish that an allowance was the attack method, and revocation cannot be presented as recovery of the reported loss.

If you cannot confidently connect a permission to the application you used, record the address and transaction hash before making a new decision. Keep the distinction between information you recognize in your own wallet and a link someone sent you after the alert. There is no need to sign an unfamiliar request simply to inspect an existing transaction record.

A check for exchange users

If your TENDRIL activity was through an exchange account, open that account directly and inspect the actual product and transaction status. Do not infer a deposit suspension, delisting or withdrawal freeze from this pool report. Neither PANews nor Odaily verifies such an exchange action in the opened item.

For a transfer you already submitted, retain its transaction hash and the receiving address. Compare the network used with the record in your account before repeating the transfer. A second transaction should not be sent solely because a social post claims that the first one failed. This is a suggested way to examine your own records, not a claim that an exchange has reported a failure.

For any position you still hold, separate the pool-security question from the order you are considering. The incident reports contain no verified current TENDRIL price, trading volume or market depth. We cannot turn the loss figure into a price forecast or say that a particular sell order can execute at a displayed quote.

You can consult the funding-rate board and liquidation page for their own stated market coverage. Neither page is cited here as evidence of the pool attack, and no figures from those tools have been added to the reported loss.

What a useful next update would contain

A transaction hash and identified pool address would let readers compare the alert with their own interactions. A technical account would need to show how the relevant contracts behaved. A recovery statement would need to identify the amount recovered and its destination. These are the pieces to look for in a follow-up, rather than another repetition of the same estimate.

Until those details are available, keep the incident described at the level the opened reports support. TenArmorAlert's finding was reported by two outlets; independent forensic confirmation was not established in this run. We will need additional evidence before narrowing the affected contracts or describing a completed response.

Quick answers

Was $309,000 taken from every USDT holder?

The reports concern a TENDRIL/USDT pool on BSC. They do not identify all USDT holders as affected or give a per-user loss calculation.

Does disconnecting a wallet remove token permissions?

MetaMask treats disconnecting an application and revoking its approvals as different operations. Inspect the allowance when reviewing permissions.

Does revoking an approval bring the money back?

The official guide describes removal of an allowance through an on-chain transaction. The opened incident reports establish no recovery through that action.

Has a cause been confirmed?

The fetched news items describe a suspicious attack and attribute the estimate to TenArmorAlert. They do not supply a verified exploit mechanism or final incident report.