Nemo Hack: Auditor Flagged Issue Before $2.59M Exploit

September 11, 2025 — Yield trading protocol Nemo, built on the Sui blockchain, has admitted that an exploit draining $2.59 million could have been prevented if its team had acted on an auditor’s warning. The September 7 Nemo hack stemmed from unaudited code deployed without proper multisignature protections.

Nemo Hack Rooted in Known Vulnerability

Nemo’s post-mortem revealed that the exploit targeted a function called get_sy_amount_in_for_exact_py_out. This piece of code, meant to manage slippage, was deployed onchain without a full audit. Asymptotic, the protocol’s smart contract auditor, had already identified the flaw in a preliminary review.

The Nemo team admitted it “did not adequately address this security concern in a timely manner.” A single developer was able to deploy the code with only one signature, bypassing recommended procedures such as multisignature approval and confirmation hash verification.

Auditor Warning Ignored

The vulnerability was introduced in January 2025, but Nemo only implemented an upgrade procedure in April, too late to stop the risky code from going live. Asymptotic again warned the team on August 11, but Nemo prioritized other issues and left the flaw unpatched until attackers exploited it in September.

This echoes other preventable crypto incidents, including SuperRare’s $730,000 loss in July due to an overlooked smart contract bug.

Nemo Pauses Protocol, Prepares Fix

Following the Nemo hack, the project has paused all core functions and is working with security teams to freeze assets linked to the attacker on centralized exchanges.

A patch is now under audit by Asymptotic. Nemo has removed its flash loan function, fixed the vulnerable code, and added a manual reset mechanism for restoring values. A user compensation plan is in the works, including debt structuring at the tokenomics level.

In its statement, Nemo said:
“Security and risk management demand constant vigilance. We are committed to stronger defences and stricter protocol controls going forward.”

Extra Context: Security Gaps in DeFi

The Nemo hack highlights ongoing issues in decentralized finance security:

• Single-signature control — bypassing multisig checks leaves systems exposed.
• Ignored auditor warnings — flagged vulnerabilities need prompt resolution.
• Slow governance upgrades — delays allow flaws to persist in production.

Industry experts argue that greater emphasis on audited code, multisignature deployment, and ongoing monitoring could prevent many exploits.

Conclusion

The $2.59 million Nemo hack underscores the risks of deploying unaudited code and ignoring security warnings. While Nemo has promised stronger controls and a user compensation plan, the incident highlights the urgent need for rigorous security practices across DeFi.

The Talk

Real voices. Real reactions.

Sentiment on Social Media: 😠

KOLsMediaCommunity

@nemoprotocol @williamm168 @movebit You’re still not answering the real questions here what are the affected pools and vaults? everyone wants to know! Is there a plan for refund moving forward?

"As many of you know, Nemo Protocol suffered a security incident on Sept 8. Today we are releasing our full incident report to provide transparency into our response, including the root cause, learnings, and next steps. We sincerely apologize for the impact on @Movebit and for the https://t.co/ROml1aUNUv"— @

Onchain | 📘💧

@ziddy_aare

about 16 hours ago

@nemoprotocol @movebit Thanks for the technical clarification but what we really need to know is: Which pools or markets were affected? Are our funds among those stolen? Will we get them back and when? These are the key questions I believe you should be answering for your users right now.

"As many of you know, Nemo Protocol suffered a security incident on Sept 8. Today we are releasing our full incident report to provide transparency into our response, including the root cause, learnings, and next steps. We sincerely apologize for the impact on @Movebit and for the https://t.co/ROml1aUNUv"— @

Conco

@concodefi

about 17 hours ago

@nemoprotocol @movebit Soooo….when will portfolios be restored and we can figure out what is left? Are all of our tokens gone? I am confused of projected outlook. All you outlined was how the hack happened.

"As many of you know, Nemo Protocol suffered a security incident on Sept 8. Today we are releasing our full incident report to provide transparency into our response, including the root cause, learnings, and next steps. We sincerely apologize for the impact on @Movebit and for the https://t.co/ROml1aUNUv"— @

Bofby.sui

@BlockchainBofby

about 17 hours ago

Do you want to read and know more about Altcoins? Check out our Altcoin Arena for sentiment analysis, latest updates, community reactions, price predictions and project reviews on the best altcoins in crypto.