Background report. This happened on 2022-10-06. We publish it for context and as a reference. It is not today's news.
On October 6-7, 2022, an attacker exploited a vulnerability in the BNB Chain's BSC Token Hub bridge, minting approximately 2 million BNB tokens worth ~$570 million. The exploit involved forging fraudulent withdrawal proofs to extract tokens from the cross-chain bridge. Binance CEO Changpeng Zhao and validators quickly paused the BNB Smart Chain at block 110,217,401, containing the incident and limiting actual losses to approximately $100-110 million. In June 2023, the U.S. Department of Justice announced the seizure of $112 million in cryptocurrency linked to the hack.
We message you the minute a major hack, exploit or fraud is confirmed, with the amount lost and what to do. Free, no spam, stop any time.
On October 6, 2022, an attacker exploited a critical vulnerability in the BSC Token Hub, the bridge contract responsible for transferring assets between BNB Beacon Chain and BNB Smart Chain. The attacker was able to forge fraudulent withdrawal proofs that convinced the bridge to release BNB tokens that were never legitimately deposited.
The exploit allowed the attacker to mint approximately 2 million BNB tokens, valued at roughly $570 million at the time. The attacker's primary address was identified as 0x489A8756C18C0b8B24EC2a2b9FF3D4d447F79BEc. Once minted, the attacker began moving funds through various DeFi protocols and converting tokens to other assets.
Binance's response was swift and controversial. CEO Changpeng Zhao coordinated with BNB Chain validators to temporarily suspend the blockchain at block height 110,217,401, effectively freezing the attacker's ability to move the majority of stolen funds. This emergency halt prevented the attacker from bridging most of the exploited tokens off the BNB Chain.
The chain halt and validator coordination successfully limited the actual damage to approximately $100-110 million, as the attacker was only able to move a fraction of the exploited funds before the freeze. Binance froze approximately $7 million directly and worked with law enforcement on recovery efforts.
The attack targeted the BSC Token Hub bridge contract, which facilitates cross-chain transfers between BNB Beacon Chain and BNB Smart Chain. The attacker exploited a vulnerability in the proof verification mechanism that validates withdrawal requests. By crafting fraudulent IAVL (Immutable AVL Tree) proofs, the attacker was able to convince the bridge contract that legitimate deposits had been made on the Beacon Chain side, when in fact no such deposits existed.
These forged proofs bypassed the bridge's security checks, allowing the attacker to mint BNB tokens on the Smart Chain side without providing corresponding collateral. The vulnerability lay in insufficient validation of the merkle proofs used to verify cross-chain messages. Once the fraudulent withdrawals were approved, the attacker received freshly minted BNB tokens directly into their controlled address.
The attacker then attempted to quickly move and convert the stolen BNB through decentralized exchanges and DeFi protocols to obscure the trail and extract value before detection. However, the rapid response by Binance and validators to halt the chain prevented the majority of the funds from being successfully laundered or bridged to other blockchains.
Attacker address 0x489A8756C18C0b8B24EC2a2b9FF3D4d447F79BEc received ~2M BNB from the exploit. Funds were partially moved through DeFi protocols and converted to other tokens before the chain halt. Approximately $7M was frozen by Binance directly. The chain suspension prevented the majority (~$460M) from being moved. In June 2023, U.S. DOJ seized $112M linked to the incident, suggesting successful law enforcement tracking and recovery of a portion of the stolen funds that escaped the initial freeze.
| Address | Chain | Role | Source |
|---|---|---|---|
0x489A8756C18C0b8B24EC2a2b9FF3D4d447F79BEc | BNB Chain | exploiter | source |
Every address is from a public source. Check any wallet in the dirty wallet checker.
Binance's response was exceptionally fast and decisive. Within hours of detecting the exploit, CEO Changpeng Zhao coordinated with BNB Chain validators to halt the blockchain entirely, preventing further movement of stolen funds. The company publicly disclosed the incident via Twitter and official announcements, explaining the nature of the exploit and the emergency measures taken. Binance worked with validators to implement security patches before resuming chain operations on October 12, 2022. The company froze approximately $7 million directly and cooperated with law enforcement, leading to the DOJ's $112 million seizure in June 2023. Binance covered user losses and did not require users to bear the cost of the exploit.
BNB token price dropped approximately 3-4% immediately following the announcement, reflecting market concern but relatively limited panic given the quick containment. The incident sparked significant debate about blockchain decentralization, as the ability to halt an entire blockchain through validator coordination raised questions about BNB Chain's centralization versus security trade-offs. Users on BNB Chain experienced temporary service disruption during the chain halt. The broader crypto market showed limited contagion, as Binance's rapid response and transparent communication prevented wider panic. The incident highlighted ongoing vulnerabilities in cross-chain bridges, which have been frequent targets for exploits.
45% negative · 30% positive · the rest neutral · themes: Centralization concerns over chain halt capability, Appreciation for quick response limiting losses, Ongoing bridge security vulnerabilities, Questions about validator coordination power, Relief that user funds were protected, Debate over decentralization vs security trade-offs
How we report: Sentinel reads news, investigators' posts, company statements and on-chain data, attributes every claim to its source and marks unconfirmed numbers as reported. Severity measures size and systemic risk; the response score measures how fast and transparently users were protected. Not financial advice and not a finding of guilt. Corrections: contact us.
New exploit reports, major incidents and security updates from VaultX. Free. You choose below; nothing starts until you opt in.
On Telegram, press Start in the bot to subscribe. New reports are also posted on our alerts channel. Not financial advice.
VaultX