{"id":275,"date":"2022-10-12T08:21:00","date_gmt":"2022-10-12T08:21:00","guid":{"rendered":"https:\/\/odwstage.com\/omniatech\/?p=275"},"modified":"2023-05-21T21:34:21","modified_gmt":"2023-05-21T21:34:21","slug":"bnb-chain-lost-100m-to-a-hack-what-went-wrong","status":"publish","type":"post","link":"https:\/\/omniatech.io\/pages\/bnb-chain-lost-100m-to-a-hack-what-went-wrong\/","title":{"rendered":"BNB Chain Lost $100M To a Hack – What Went Wrong?"},"content":{"rendered":"<\/span> 3<\/span> min read<\/span><\/span>\n

Early October 7th, CZ announced via Twitter<\/a> that the BNB Smart Chain was experiencing an exploit on its cross-chain bridge, BSC Token Hub, that had resulted in the minting and transfer of extra BNB. <\/p>\n\n\n\n

Attacker Forged Proofs that Allowed them to Mint 2M BNB<\/h2>\n\n\n\n

The BNB Chain team soon published a blog post<\/a> explaining that the attacker had managed to carry out \u2018sophisticated forging of the low-level proof into one common library.\u2019 <\/p>\n\n\n\n

Adrian Hetman, tech lead of the Triaging Team at Immunefi, a Web3 bug bounty program provider, explained in an interview with TechCrunch<\/a> that the bug in the cross-chain bridge allowed the hacker to trick the logic of its smart contract into thinking their message proofs were valid \u2018even though the hacker didn\u2019t have valid claims to the funds.\u2019 <\/p>\n\n\n\n

By doing so, the attacker convinced the cross-chain bridge to send them 1,000,000 BNB twice, the equivalent of $570 million at the time. In simple terms, the attacker had figured out a way of minting new BNB tokens.<\/p>\n\n\n\n

Hacker Tried to Move the Funds to Different Chains<\/h2>\n\n\n\n

An initial investigation<\/a> by the team at SlowMist revealed that the attacker then attempted to launder the funds through a series of transactions beginning with a 900k BNB deposit to Venus Protocol to borrow 62 million BUSD, 50 million USDT, and 35 million USDC. The attacker also began spreading their loot on the various networks to try to cover their tracks.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Attacker\u2019s attempt to launder the stolen funds. Source, SlowMist on Twitter<\/a> <\/p>\n\n\n\n

BNB Chain Was Successfully Paused, Preventing the Entire $570M from Being Stolen<\/h2>\n\n\n\n

At the same time, the BNB Chain team was working fast to mitigate the enormity of the hack. The team opted to contact all 26 active community validators in 44 different time zones to stop the incident from spreading. A decision was then made to suspend<\/a> the BNB Smart chain to contain the exploit and help freeze any additional transfers. <\/p>\n\n\n\n

According to the SlowMist team, the suspension of the chain helped save an estimated $430 million worth of digital assets, with the attackers getting away with an estimated $110 million. CZ also gave a similar figure<\/a> of $100 million lost due to the exploit. <\/p>\n\n\n\n

User Funds Were Not Affected, and the BNB Chain was Not Rolled Back<\/h2>\n\n\n\n

The BNB Smart Chain was restarted<\/a> on the same day of the hack. The team soon released a hot-fix and hard fork of the blockchain that included the blacklisting of addresses to prohibit a continuation of the exploit. <\/p>\n\n\n\n

In an additional update<\/a> of the event, the BNB Chain team explained that the blockchain was not compromised and no user funds were affected since the attacker had minted new BNB tokens. They also clarified that the blockchain \u2018was never rolled back\u2019 and its validators carried out \u2018a synchronized pause and resume.\u2019 <\/p>\n\n\n\n

Proposed Actions for the BNB Chain Moving Forward<\/h2>\n\n\n\n

The team at the BNB Chain has since proposed governance votes to determine the following four actions moving forward. <\/p>\n\n\n\n