BNB Chain Halts Operation Due To 'Irregular Activity'

Crypto exchange Binance's blockchain, BNB Chain, has been halted due to an attack on the cross-chain bridge between BNB Beacon Chain (BEP2) and BNB Chain (BEP20 or BSC).

Changpeng "CZ" Zhao, the CEO of the world's largest exchange, confirmed the Thursday attack via a Twitter post, adding that the cross-chain bridge named BSC Token Hub has been exploited and resulted in extra BNB. BNB Chain is the third biggest blockchain in terms of total value locked (TVL).

"We have asked all validators to temporarily suspend BSC. The issue is contained now. Your funds are safe. We apologize for the inconvenience and will provide further updates accordingly," Zhao said.

An exploit on a cross-chain bridge, BSC Token Hub, resulted in extra BNB. We have asked all validators to temporarily suspend BSC. The issue is contained now. Your funds are safe. We apologize for the inconvenience and will provide further updates accordingly.
— CZ 🔶 Binance (@cz_binance) October 6, 2022

He added that the "current impact estimate is around $100 million USD equivalent, about a quarter of the last BNB burn."

"Thanks to the community and our internal and external security partners, an estimated $7M has already been frozen," said the official Reddit post by a BNB chain developer.

The crypto community first noted that more than $400 million worth of BNB tokens were transferred from the Smart Chain token hub to a new address and as per data from DeBank, the address currently holds many other altcoins and over $500 million worth of crypto in ETH, MATIC and FTM, etc.

With the help of popular blockchain analyst ZachXBT, Sam Sun, research heat at crypto firm Paradigm, found out the address of the attacker who transferred around 2 million BNB tokens into his own wallet. "Either someone had pulled off a huge rug, or there was a massive hack underway," stated Sun.

It all started when @zachxbt sent me the attacker's address out of the blue. When I clicked into it, I saw an account worth hundreds of millions of dollars. Either someone had pulled off a huge rug, or there was a massive hack underway pic.twitter.com/OipdKymjFL
— samczsun (@samczsun) October 6, 2022

Sun pointed out that the attacker somehow convinced the BSC Token Hub to send him 1 million BNB tokens two times although the bridge had 150 million BNB tokens.

"There was a bug in the way that the Binance Bridge verified proofs which could have allowed attackers to forge arbitrary messages. Fortunately, the attacker here only forged two messages, but the damage could have been far worse," Sun said.

It seems that the attacker wanted to stay under the radar and see how much they could make away with and as a result, only transferred 2 million BNB.