Nemo Protocol Loses $2.6M Due to Unaudited Developer Code

Nemo Protocol suffered a $2.59 million exploit on September 7, triggered by unaudited code deployed by a developer. The breach caused the platform's Total Value Locked (TVL) to plummet from over $6 million to roughly $1.5 million, with $2.4 million stolen and later bridged to Ethereum.

A post-mortem report revealed the root cause: an unnamed developer introduced new features without audit approval, failing to flag them to MoveBit auditors. The attacker exploited a mistakenly public flash loan function and a flawed pricing mechanism, highlighting the critical need for rigorous code reviews in DeFi.

The incident underscores the persistent vulnerabilities in decentralized finance, where unvetted code can lead to catastrophic losses. Nemo Protocol's transparency in disclosing the breach sets a precedent for accountability, but the damage to user trust may linger.