BNB Chain bridge exploit (BSC Token Hub)
From Invertopedia, the encyclopedia of how things fail
BSC Token Hub was a cross-chain bridge[1]. On October 6, 2022, an attacker forged proofs and had it release 2 million BNB, about $586 million at the time[4][2]. Only about $127 million to $137 million reached other chains before validators suspended the chain, which stayed paused for about 8 hours[2][3].
What happened
| Oct 5, 2022 | A ChangeNOW wallet sends the attacker 100 BNB, which is used to register as a relayer for the bridge.[3] |
|---|---|
| Oct 6, 2022 | The attacker uses forged proofs to withdraw a total of 2 million BNB.[4][2] |
| Oct 6, 2022 | Binance chief executive Changpeng Zhao says an exploit on the bridge produced extra BNB and validators are asked to suspend BSC.[1] |
| Oct 7, 2022 | BNB Chain confirms 2 million BNB was withdrawn and announces bounty programs.[4] |
The kill shot
The bridge accepted a forged proof of a deposit that never happened, so the attacker could mint money the chain believed was real.
BNB Chain described it as a sophisticated forging of the low level proof into one common library[4]. Rekt reported the proof was forged against an old block, 110217401 from August 2020, using weak IAVL verification[2]. The chain had 26 active validators out of 44 in total, spread across different time zones[4].
The inversion
A bridge is only as safe as its proof check. Test that the verifier rejects a forged message, and be able to stop the chain faster than one phone call per validator.
What survived
BNB Chain announced a whitehat program paying $1 million for each significant bug and a bounty of up to 10 percent of recovered funds for catching the hackers[4].
References
- ^ “Binance's BNB Smart Chain halts after $100 million exploit, CZ says”. Fortune, Oct 6, 2022. Zhao's statement and the validator suspension.
- ^ “BNB Bridge - REKT”. Rekt News, Oct 2022. Dollar figures, block height, the halt.
- ^ “BNB Chain's Cross-Chain Bridge Exploit Explained”. Nansen, Oct 15, 2022. Relayer registration, timing, amount moved out.
- ^ “BNB Chain Ecosystem Update”. BNB Chain blog, Oct 7, 2022. The team's account, validators, planned votes and bounties.