# Binance BNB Chain Bridge Exploit: Binance halts BNB Chain after $570M bridge exploit, recovers most funds through validator action
Source page: https://vaultx.llc/hacks/binance-hack-seizure-november-2026 · VaultX incident report by Sentinel · first published 2026-11-14, updated 2026-11-14
- Date: 2022-10-06
- Reported loss: $570M (Initially ~$570M exploited; actual loss reduced to ~$100-110M after chain halt and recovery)
- Attribution: Unknown attacker; exploiter address 0x489A8756C18C0b8B24EC2a2b9FF3D4d447F79BEc according to on-chain data
- Chains: BNB Chain, BNB Smart Chain
- Status: resolved
- Severity: 72/100
- Response score: 85/100 (Exceptionally fast chain halt within hours, transparent communication, full user protection, successful law enforcement cooperation)
On October 6-7, 2022, an attacker exploited a vulnerability in the BNB Chain's BSC Token Hub bridge, minting approximately 2 million BNB tokens worth ~$570 million. The exploit involved forging fraudulent withdrawal proofs to extract tokens from the cross-chain bridge. Binance CEO Changpeng Zhao and validators quickly paused the BNB Smart Chain at block 110,217,401, containing the incident and limiting actual losses to approximately $100-110 million. In June 2023, the U.S. Department of Justice announced the seizure of $112 million in cryptocurrency linked to the hack.

**What happened**
On October 6, 2022, an attacker exploited a critical vulnerability in the BSC Token Hub, the bridge contract responsible for transferring assets between BNB Beacon Chain and BNB Smart Chain. The attacker was able to forge fraudulent withdrawal proofs that convinced the bridge to release BNB tokens that were never legitimately deposited.
The exploit allowed the attacker to mint approximately 2 million BNB tokens, valued at roughly $570 million at the time. The attacker's primary address was identified as 0x489A8756C18C0b8B24EC2a2b9FF3D4d447F79BEc. Once minted, the attacker began moving funds through various DeFi protocols and converting tokens to other assets.
Binance's response was swift and controversial. CEO Changpeng Zhao coordinated with BNB Chain validators to temporarily suspend the blockchain at block height 110,217,401, effectively freezing the attacker's ability to move the majority of stolen funds. This emergency halt prevented the attacker from bridging most of the exploited tokens off the BNB Chain.
The chain halt and validator coordination successfully limited the actual damage to approximately $100-110 million, as the attacker was only able to move a fraction of the exploited funds before the freeze. Binance froze approximately $7 million directly and worked with law enforcement on recovery efforts.

**How it worked**
The attack targeted the BSC Token Hub bridge contract, which facilitates cross-chain transfers between BNB Beacon Chain and BNB Smart Chain. The attacker exploited a vulnerability in the proof verification mechanism that validates withdrawal requests. By crafting fraudulent IAVL (Immutable AVL Tree) proofs, the attacker was able to convince the bridge contract that legitimate deposits had been made on the Beacon Chain side, when in fact no such deposits existed.
These forged proofs bypassed the bridge's security checks, allowing the attacker to mint BNB tokens on the Smart Chain side without providing corresponding collateral. The vulnerability lay in insufficient validation of the merkle proofs used to verify cross-chain messages. Once the fraudulent withdrawals were approved, the attacker received freshly minted BNB tokens directly into their controlled address.
The attacker then attempted to quickly move and convert the stolen BNB through decentralized exchanges and DeFi protocols to obscure the trail and extract value before detection. However, the rapid response by Binance and validators to halt the chain prevented the majority of the funds from being successfully laundered or bridged to other blockchains.

**Where the money went**
Attacker address 0x489A8756C18C0b8B24EC2a2b9FF3D4d447F79BEc received ~2M BNB from the exploit. Funds were partially moved through DeFi protocols and converted to other tokens before the chain halt. Approximately $7M was frozen by Binance directly. The chain suspension prevented the majority (~$460M) from being moved. In June 2023, U.S. DOJ seized $112M linked to the incident, suggesting successful law enforcement tracking and recovery of a portion of the stolen funds that escaped the initial freeze.

**The response**
Binance's response was exceptionally fast and decisive. Within hours of detecting the exploit, CEO Changpeng Zhao coordinated with BNB Chain validators to halt the blockchain entirely, preventing further movement of stolen funds. The company publicly disclosed the incident via Twitter and official announcements, explaining the nature of the exploit and the emergency measures taken. Binance worked with validators to implement security patches before resuming chain operations on October 12, 2022. The company froze approximately $7 million directly and cooperated with law enforcement, leading to the DOJ's $112 million seizure in June 2023. Binance covered user losses and did not require users to bear the cost of the exploit.

**Impact**
BNB token price dropped approximately 3-4% immediately following the announcement, reflecting market concern but relatively limited panic given the quick containment. The incident sparked significant debate about blockchain decentralization, as the ability to halt an entire blockchain through validator coordination raised questions about BNB Chain's centralization versus security trade-offs. Users on BNB Chain experienced temporary service disruption during the chain halt. The broader crypto market showed limited contagion, as Binance's rapid response and transparent communication prevented wider panic. The incident highlighted ongoing vulnerabilities in cross-chain bridges, which have been frequent targets for exploits.

**Wallets linked to this case**
- 0x489A8756C18C0b8B24EC2a2b9FF3D4d447F79BEc (BNB Chain, exploiter) source: https://www.justice.gov/opa/pr/112-million-cryptocurrency-stolen-binance-recovered

**Timeline**
- 2022-10-06 Attacker exploits BSC Token Hub bridge vulnerability, minting ~2 million BNB (~$570M)
- 2022-10-06 Binance detects exploit; CZ and validators coordinate emergency chain halt at block 110,217,401
- 2022-10-07 BNB Chain remains paused while validators assess damage and implement fixes
- 2022-10-07 Binance announces ~$7M frozen and confirms actual loss limited to ~$100-110M
- 2022-10-12 BNB Chain resumes operations after security patches and validator consensus
- 2023-06 U.S. Department of Justice announces seizure of $112M in cryptocurrency linked to the hack

**How to protect yourself**
- Cross-chain bridges remain critical vulnerability points requiring rigorous proof verification and multiple security layers
- Emergency response capabilities (like validator coordination to halt chains) can dramatically limit exploit damage, though they raise decentralization concerns
- Users should understand the centralization trade-offs of the chains they use—BNB Chain's validator structure enabled rapid response but differs from more decentralized networks
- Law enforcement cooperation and blockchain forensics can lead to significant fund recovery even months after an incident
- Projects should have clear incident response plans and communication protocols to maintain user trust during crises

**Still unknown**
- Identity of the attacker(s) remains unknown despite law enforcement seizure
- Exact technical details of how the fraudulent proofs were constructed
- Whether the $112M DOJ seizure represents all recoverable funds or if additional recovery efforts continue
- Full breakdown of where the ~$100M in actual losses went and current location of unrecovered funds
- Whether the attacker(s) had inside knowledge of the bridge contract or discovered the vulnerability through external analysis

**Sources**
- DOJ Press Release - $112 Million Cryptocurrency Stolen from Binance Recovered https://www.justice.gov/opa/pr/112-million-cryptocurrency-stolen-binance-recovered
- Binance Blog - Security Incident Recap https://www.binance.com/en/blog/421499824684901157/security-incident-recap
- Binance Support - BNB Smart Chain Mainnet Recovery Update https://www.binance.com/en/support/announcement/bnb-smart-chain-mainnet-recovery-update-c2f3e5fd0e984bd1b8c0d81fe7e33f9d
- Binance Support - BNB Smart Chain Incident Investigation and Reimbursement https://www.binance.com/en/support/announcement/binance-completes-bnb-smart-chain-incident-investigation-and-reimbursement-c3c79e7b3f5d4b6c9e0f8f3e3c8b0f3e

---
VaultX: free crypto news and intelligence, https://vaultx.llc