Smart contract vulnerability in BNB cross-chain bridge exploited in October 2022 incident
On October 4, 2022, hackers executed a sophisticated cyberattack against Binance's cryptocurrency infrastructure, exploiting a critical vulnerability in the BSC Token Hub—a cross-chain bridge connecting BNB Beacon Chain and BNB Chain. The attack went undetected for two days until Binance publicly acknowledged the incident on October 6, announcing a temporary suspension of BNB Smart Chain transactions.
The stolen assets totaled approximately 2 million BNB tokens, worth roughly $570 million at the time of the breach. What made this attack particularly notable was the method: rather than targeting user wallets, the hackers exploited a flaw in the bridge's smart contract that verified cross-chain proofs. The vulnerability allowed attackers to forge proof messages by bypassing the system's Merkle tree verification process—failing to validate the Merkle tree all the way to the root hash. This gap in security enabled the criminals to mint 2 million new BNB coins directly into their own wallet.
To execute the exploit, the attacker first registered as a relayer on the system—a role designed to facilitate legitimate cross-chain transactions. This insider-like positioning allowed them to set up and deploy the attack with minimal resistance from the network's detection systems.
Cyberangriff auf Binance
Unbekannte Hacker stehlen rund 2 Millionen BNB-Token im Wert von etwa 570 Millionen Euro durch Ausnutzung einer Schwachstelle im BSC Token Hub.
BNB Smart Chain wird pausiert
Binance stoppt die gesamte BNB Smart Chain, um weitere Abhebungen zu verhindern und das Problem einzudämmen. Etwa 7 Millionen Euro der gestohlenen Mittel können eingefroren werden.
Ankündigung von Belohnungsprogrammen
Binance kündigt Governance-Abstimmungen über eine 10-Prozent-Belohnung (ca. 57 Millionen Euro) für Hinweise auf die Täter sowie ein Bug-Bounty-Programm über 1 Million Euro an.
Binance's response was swift. Immediately upon discovering the breach, the exchange suspended all transactions on BNB Chain to prevent further damage. The company, along with community members and security partners, managed to freeze approximately $7 million in stolen funds—a recovery representing only a fraction of the total loss. CEO Changpeng Zhao attempted to reassure users through social media, tweeting: "The issue is contained now. Your funds are safe."
Initial assessments suggested that roughly $100-110 million of the stolen cryptocurrency had been moved off-chain, making recovery more difficult. However, the company emphasized a crucial distinction: no user funds were compromised in the attack. The stolen tokens were newly minted BNB coins created through the smart contract exploit, not assets withdrawn from customer accounts.
The Binance hack reflected a broader vulnerability plaguing the cryptocurrency ecosystem. This incident was one in a series of cross-chain bridge exploits that plagued 2022, following the Nomad bridge hack just weeks earlier in August, which resulted in approximately $200 million in losses. These vulnerabilities have highlighted systemic risks in the design and verification processes of blockchain bridges—critical infrastructure connecting different blockchain networks.
As of the latest available information, the perpetrators remain unidentified. No arrests have been made, and the identity or identities of the attacker or attackers remain unknown. The incident has not resulted in any formal verdicts or criminal charges, leaving the hacker's status as a mystery.
The attack served as a stark reminder of the security challenges facing even the world's largest cryptocurrency exchanges and the technical complexities of cross-chain infrastructure. For Binance and the broader crypto community, it underscored the importance of rigorous smart contract auditing and verification protocols—gaps that, if left unaddressed, could expose billions in assets to similar exploits.
**Sources:** https://siliconangle.com/2022/10/07/hackers-steal-570m-cryptocurrency-binances-bnb-chain/ https://purplesec.us/breach-report/binance-coin-hack/ https://www.cbsnews.com/news/binance-hack-100-million-cryptocurrency-/ https://www.infosecurity-magazine.com/news/hacker-steals-over-570m-from/