The BNB chain was temporarily halted after an exploit in its cross-chain bridge. The current estimate of the impact is around $100 million and the equivalent of $110 million in cryptocurrencies.

According to the latest update, the BNB chain is back to business as usual, but let’s take a look at how the attack came about, according to a popular researcher.

the feat

Sam Sun, paradigm researcher fixed that the attacker somehow convinced Binance Bridge to send 1 million BNB to an address he controlled. They repeated the step twice. After comparing the attacker’s transactions to legitimate withdrawals, Sun noted that the height used by the attacker was always the same: 110217401. However, the heights used by legitimate withdrawals were much higher, such as 270822321, the researcher noted.

In addition, he noted that the attacker’s proof was noticeably shorter than the legitimate withdrawal proof, meaning they had found a way to “fake a proof” for that specific block: 110217401.

Binance has a special precompile contract that is used to verify IAVL trees. When a user verifies an IAVL tree, they must specify a list of “operations”. Binance Bridge typically expects two of them: an “iavl:v” operation and a “multi-store” operation, Sun specified. The attacker managed to exploit the bug in Binance Bridge that verified tests that allowed attackers to spoof arbitrary messages.

While the attacker only forged two messages, the researcher said the damage could have been much worse.

the same dilemma

Binance CEO Changpeng Zhao confirmed the exploit after validators were asked to temporarily suspend the BSC and revealed that the issue had been contained.

“Initial estimates of funds drawn from BSC range from $100 million to $110 million. However, thanks to the community and our internal and external security partners, approximately $7 million has already been frozen. We are humbled by the community’s speed and collaboration in freezing funds.”

The latest BNB Chain exploit and subsequent steps taken by Binance may have done some damage control, but the community faces the same dilemma around decentralization once again. Bartek Kiepuszewski, blockchain architect at MakerDAO, expressed a similar sentiment in his cheep with respect to it,

“Do we want a simple bridge but with trusted validators that can censor, freeze or seize funds or do we want a trustless but significantly more complicated infrastructure?”

Binance Free $100 (Exclusive) – Use this link to sign up to receive $100 free and 10% off Binance Futures first month fees (terms).

PrimeXBT Special Offer: Use this link to sign up and enter the code POTATO50 to receive up to $7,000 on your deposits.

This post This is how the multi-million dollar BNB chain hack happened: Paradigm Researcher

was published first on


Write A Comment