Analysis: An article on the entire process of $500 million BNB theft

On the early morning of October 7th, the smart contract platform BNBChain was attacked by hackers. In just two hours, 2 million BNBs were looted, and the total amount involved in the attack reached 700 million US dollars, including 570 million US dollars in BNBs

On the early morning of October 7th, the smart contract platform BNBChain was attacked by hackers. In just two hours, 2 million BNBs were looted, and the total amount involved in the attack reached 700 million US dollars, including 570 million US dollars in BNBs. The amount involved in the attack was huge and widespread, making it the highest hacker attack in history.

Later, Changpeng Zhao, CEO of Coin Security, once known as "the richest man of Chinese people", said on the social platform that the attack that shook the entire industry was mainly caused by a loophole in the TokenHub across the chain bridge.

After detecting the loophole in the bridge between the two blockchains, BNBChain has suspended Trading halt and fund transfer. Changpeng Zhao, CEO of Coincident Security, tweeted that this problem involves BSCTokenHub, a cross chain bridge that can transfer digital assets and information from an independent block Chain transfer to another blockchain.

In addition, according to independent analysts on the social media account CIAOfficer, the hacker attack currently includes 1.04 million BNBs, $389 million venusBNBs, and $28 million BUSD, totaling $718 million, making it the largest on chain attack in history.

Once the news was released, BNB prices fell by nearly 5% within 2 hours, reaching a low of $278.7. They are now quoted at $284, a 24-hour decrease of 4.24%. At 6 o'clock this morning, BNBChain officially announced a suspension of operation to investigate potential vulnerabilities. The team stated that only $70 million to $80 million of stolen assets were transferred to other public or offline chains, and the remaining $400 million of BNB in the attacker's wallet had been frozen.

Changpeng Zhao, the founder of Binance, said on social media that at present, King'an has asked all verifiers to suspend the BSC network. The user's funds are safe. He apologized for the inconvenience caused to the user and will provide further updates accordingly.

According to BNBChain, the initial estimate of the funds extracted from BSC is between $100 million and $110 million. Subsequently, USDT's parent company, Tether, immediately blacklisted the hacker address. Thank you to the community and our internal and external security partners, an estimated $7 million has been frozen

Attack method:

When conducting cross chain transaction verification, the Coin An Cross Chain Bridge BSCTokenHub uses a special precompiled contract to verify the IAVL tree. And there is a vulnerability in this implementation, which may allow attackers to forge arbitrary messages.

Hackers exploited the BNBChain vulnerability to launch attacks at block height 21957793 by calling contracts, obtaining 1 million BNBs. Subsequently, the hacker launched another attack by calling the contract at block height 21960470 and obtained another 1 million BNBs.

After the two attacks, the hacker obtained a total of 2 million BNBs (about US $560 million) from the BNBChainBSCTokenHub, and pledged 900000 of them to the BNBChain loan agreement Venus, lending 62.5 million BUSD Stablecoin, 50 million USDT Stablecoin and 35 million USDC.

According to analysis, BNBChain attackers have transferred about $89.5 million (about RMB 636 million) of stolen funds to other blockchains, about 58% of which have been transferred to Ethereum, about 33% to Fantom, and about 4.5% to Arbitrum.

According to slow fog analysis, the initial source of funds for the hacker was ChangeNOW, and the hacker's address had interacted with multiple DApps, including Multichain, VenusProtocol, AlpacaFinance, Stargate, Curve, Uniswap, TraderJoe, PancakeSwap, SushiSwap, etc.

Yu Xian, the founder of Slow Fog, commented: From the perspective of theft and coin washing techniques, this wave of hackers is quick, accurate, and ruthless. It may not have been expected that Binance is also quick, accurate, and ruthless (suspending BSC and collaborating with funds such as Tether to freeze funds). This wave of hackers is not simple, let's see if we can trace the identity of the hackers this time. However, the Chinese community has also criticized this because BNBChain did not choose a similar centralized approach to handling coin theft cases that have occurred before.

The official team of BNBChain only took 9 hours from the occurrence of the theft incident, to the suspension of node operation, and then to the restoration of the block. However, the rapid response of BNBChain's official team to the hacker attack, although timely controlling a large amount of stolen funds, once again aroused doubts in the community about the centralization of BNBChain.

The Ouke Cloud Chain Satellite TV team released a case analysis on the theft of BNBChain. When tracking the case through OKLinkBSC browser, the hacker used the ChangeNOW service to transfer the initial attack funds (over 100 BNBs) to the BSC chain as early as October 6th. Subsequently, the hacker registered the case by calling the system LayerHub contract 0x1006, and then launched an attack on the system CrossChain contract 0x2000.

Subsequently, BNBChain tweeted that BSCv1.1.15 version has been released, and BSC validators are coordinating to restore BNBChain using the latest version within an hour, including preventing hacker accounts from taking action, disabling local cross chain communication between BNB beacon chains and BNBChain. We require all node operators to try upgrading to the corresponding version, and the verification nodes and community will discuss further upgrades to completely resolve this situation.

After the incident, BNBChain published an article titled "BNBChainEcosystemUpdate", stating that there will be an on chain governance vote to determine the following four actions to safeguard BNB's common interests: how to deal with funds that have been hacked, whether to freeze or not? Do you want to use BNB automatic combustion to cover the remaining hacked funds? A white hat hacker program for future discovered vulnerabilities, with each major discovered vulnerability costing $1 million; The reward for catching hackers can reach up to 10% of the recovered funds.

The BNBChain verification node voting function will be upgraded through the BNB beacon chain in the next few days, and a new on chain governance mechanism will be introduced on BNBChain to counter and defend against potential future attacks. In the process of further decentralization, the number of community validators will continue to increase.

The theft incident, as well as BNBChain's official response, once again placed the team in the spotlight of anti centralized narrative. Some developers pointed out that the future focus of this incident will be on how BNBChain can solve the 2 million BNBTokens that have already been minted.