BNB Chain Experiences the Largest Hack in the History of Cryptocurrency Ever

New York City: BNB Chain (BSC) was the victim of a large hacking attempt around midnight on October 7 (GMT+8). The incident included a total of $700 million US dollars, including $570 million worth of BNB. The CEO of Binance, Changpeng Zhao (CZ), said that the hack that rocked the whole cryptocurrency market was brought on by a flaw in Binance’s cross-chain bridge, which is known as BSC Token Hub. As a result of this, we take a comprehensive look at this assault and arrange the whole episode according to a timetable. They are quite delighted to have extended an invitation to the security team at Beosin to investigate the attacker’s method of operation.

The Standard Operating Procedure

When confirming transactions that take place on different chains, Binance’s cross-chain bridge, known as BSC Token Hub, makes use of a unique precompiled contract to check the IAVL tree. This implementation has a security flaw that might enable an adversary to create forged versions of arbitrary messages.

1. The attacker starts by choosing a hash value from a previously submitted block that was successful (specified block: 110217401)
2. After that, create an attack payload by adding it as a leaf node to the verification IAVL tree.
3. Add a new leaf node to the IAVL tree at any random location.
4. At the same time, include an empty internal node in order to fulfill the requirements of the realization proof.
5. Make any necessary adjustments to the leaf nodes that were added in step 3, such that the root hash that was generated is equivalent to the right root hash that was chosen in step 1, in order to successfully submit the data.
6. Conclude by putting together the withdrawal evidence for this specific block (110217401). Beosin Trace is now conducting a real-time investigation on the missing money.

The Timeline of the Event (GMT +8)

12:55 a.m., on the 7th of October

At a height of 21955968 blocks, the attacker made a payment of 100 BNB to register as a Relayer by invoking the associated contract.

2:26 AM & 4:43 AM

The adversary was successful in obtaining a combined total of 2 million BNBs from the BSC Token Hub system contract on two separate occasions, each of which occurred at a different time.

BNB Chain said in a tweet that BSC is operating normally at this time. Validators are now verifying their status, and improvements are being made to the community’s infrastructure.