New hack attempt on the BNB Chain, reportedly resulting in a $100 million theft in BNB tokens.
Summary
$100 million hack on the BNB Chain
“We want to confirm that we coordinated with validators to temporarily suspend BNB Smart Chain (BSC) after having determined an exploit on a cross-chain bridge, BSC Token Hub- which resulted in extra BNB. We have asked all validators to temporarily suspend BSC. The issue is contained now. Your funds are safe. We apologize for the inconvenience and will provide further updates accordingly. The Community has already played a pivotal role in assisting and helping freeze any transfers. All funds are safe. We want to thank the node service providers for their quick and attentive response.”
With this meager statement, the BNB Chain team of developers announced the temporary suspension of service to resolve a serious hacker attempt discovered on the chain, which allegedly led to the fraudulent misappropriation of approximately $100 million of BNB funds.
The problem allegedly occurred, as has often been the case in recent hacking attempts, through the breach of a bridge between blockchains, though for the time being the problem has been “contained,” as stated on Twitter by Changpeng “CZ” Zhao, billionaire co-founder of Binance. A bridge is basically software that allows someone to send tokens from one blockchain network and receive them on another separate blockchain.
An exploit on a cross-chain bridge, BSC Token Hub, resulted in extra BNB. We have asked all validators to temporarily suspend BSC. The issue is contained now. Your funds are safe. We apologize for the inconvenience and will provide further updates accordingly.
— CZ 🔶 BNB (@cz_binance) October 6, 2022
In reality, the figure would not yet be quantified, and could even be less than $100 million, considering that according to what a company tweet claimed, $7 million would have already been frozen previously
Initial estimates for funds taken off BSC are between $70M – $80M.
However, thanks to the community and our internal and external security partners, an estimated $7M has already been frozen
1/2
— BNB Chain (@BNBCHAIN) October 6, 2022
This is an attack through a bridge breach, similar to what happened to Nomad‘s bridge in August that netted $200 million, or the even more sensational one to Axie Infinity’s Ronin bridge, the most famous DeFi game, which netted almost $600 million, last March.
Crimes in the crypto world according to Chainalysis
According to Chainalysis, a crypto analytics firm, total crypto crime revenue in the first half of this year was about $1.8 billion, slightly less than the figure recorded in the first half of 2021. This decline, however, follows the consistent drop in the crypto asset markets, and so according to some it would actually be a figure that reveals more activity by cybercriminals, compared to the previous year. Some forms of crypto-crime have increased over the past year, such as those targeting cross bridge breaches between different blockchains.
Meanwhile, the dedicated financial media outlet Bloomberg reported on how about $2 billion in crypto hacks were lost this year, with an uptick in values from the previous year. Many of these hacks were perpetrated by groups linked to North Korea, which has always been the most active country in this type of cybercrime, and the cross-chain bridges used to transfer tokens across blockchain were a favorite target for criminals.
According to data from blockchain analytics firm Chainalysis, about $1.4 billion has been lost since the beginning of the year due to breaches on these cross bridges, with the largest amount of that amount being the one perpetrated against Axie Infinity. This is more than 69% of the total thefts perpetrated by cybercriminals in the crypto sector.
Tom Robinson, co-founder and chief scientist of blockchain analytics firm Elliptic, said in an interview:
“Blockchain bridges have become the low-hanging fruit for cyber-criminals, with billions of dollars worth of crypto assets locked within them. These bridges have been breached by hackers in a variety of ways, suggesting that their level of security has not kept pace with the value of assets that they hold.”
