Nemo Hack: Auditor Flagged Issue Before $2.59M Exploit

September 11, 2025 — Yield trading protocol Nemo, built on the Sui blockchain, has admitted that an exploit draining $2.59 million could have been prevented if its team had acted on an auditor’s warning. The September 7 Nemo hack stemmed from unaudited code deployed without proper multisignature protections.

Nemo Hack Rooted in Known Vulnerability

Nemo’s post-mortem revealed that the exploit targeted a function called get_sy_amount_in_for_exact_py_out. This piece of code, meant to manage slippage, was deployed onchain without a full audit. Asymptotic, the protocol’s smart contract auditor, had already identified the flaw in a preliminary review.

The Nemo team admitted it “did not adequately address this security concern in a timely manner.” A single developer was able to deploy the code with only one signature, bypassing recommended procedures such as multisignature approval and confirmation hash verification.

Auditor Warning Ignored

The vulnerability was introduced in January 2025, but Nemo only implemented an upgrade procedure in April, too late to stop the risky code from going live. Asymptotic again warned the team on August 11, but Nemo prioritized other issues and left the flaw unpatched until attackers exploited it in September.

This echoes other preventable crypto incidents, including SuperRare’s $730,000 loss in July due to an overlooked smart contract bug.

Nemo Pauses Protocol, Prepares Fix

Following the Nemo hack, the project has paused all core functions and is working with security teams to freeze assets linked to the attacker on centralized exchanges.

A patch is now under audit by Asymptotic. Nemo has removed its flash loan function, fixed the vulnerable code, and added a manual reset mechanism for restoring values. A user compensation plan is in the works, including debt structuring at the level.