BNB Bridge Exploit - October 7, 2022
What Happened
The BSC Token Hub bridge, connecting the legacy Binance Beacon Chain to BNB Chain (formerly BSC), was exploited to illegally mint 2M BNB directly to an attacker's wallet. At the time of the incident, BNB was trading at $293, making the stolen amount worth approximately $586M.
The attacker successfully exfiltrated only $127M to other blockchains before Binance halted the chain, leaving roughly $430M stranded on the compromised BSC address.
Technical Root Cause
The bridge relied on "vulnerable IAVL verification" to validate proofs from the legacy Beacon Chain. The attacker successfully forged cryptographic proofs for block 110217401 (from August 2020), exploiting weaknesses in how the bridge verified deposit authenticity.
GitHub Reference:
bnb-chain/bsc/blob/335492482d669efa28b6e1793ba16f100f8c3d54/core/vm/contracts_lightclient.go#L106
Attack Vector & Exploit Steps
1. Proof Forgery: Attacker crafted falsified deposit proofs claiming deposits on the legacy Beacon Chain
2. Minting: Two transactions minted 1M BNB each (18:26 UTC and 20:43 UTC)
3. Liquidity Strategy: Attacker deposited 900k BNB as collateral on Venus Protocol
4. Stablecoin Borrowing: Borrowed $147M in stablecoins against the collateral
5. Bridge Escapes: Moved funds across multiple chains (Ethereum, Fantom, Avalanche, Polygon)
Exploiter Address: 0x489a8756c18c0b8b24ec2a2b9ff3d4d447f79bec
Transaction Hashes:
• 0xebf83628ba893d35b496121fb8201666b8e09f3cbadf0e269162baa72efe3b8b
• 0x05356fd06ce56a9ec5b4eaf9c075abd740cae4c21eab1676440ab5cd2fe5c57a
Financial Impact
• Total Stolen: $586M (2M BNB at $293/BNB)
• Successfully Escaped: $127M to other chains
• Stranded on BSC: ~$430M (frozen when chain halted)
• Frozen USDT: ~$6.5M (blacklisted by Tether)
Chain Halt Response
Binance paused BNB Chain for approximately 8 hours after detecting irregular activity.
Remediation
1. Governance votes on whether to freeze or burn the stolen funds
2. Bug bounty program establishment
3. Whitehat bounty program
4. Validator expansion