Table of Contents
This shocking news of the Binance’s BNB Chain hack comes just weeks after the WinterMute Hack took place.
Binance, the world’s largest cryptocurrency exchange, and its Binance Smart Chain (BNB) suffered a massive hack just 5 hours ago. The attacker managed to steal a total of 2M Binance Coins (BNB) which equals to almost USD 566M.
🔮 New learning path: Launch your own tokens on different blockchains
How did the BNB Chain hack happen?
The CEO of Binance, Changpeng Zhao, confirmed the news with a tweet. It was said that the hacker exploited a loophole in the Binance Bridge, a cross-chain bridging service that allows Ethereum and BNB blockchains to connect and transfer information and tokens between them.
The irregular activity on the chain came to notice when 20M BNB were transferred to an address. The hacker had found a critical bug and convinced Binance Bridge to send them 1M BNB, twice.
It is to be noted that the hacker generated 20 million BNB on the chain and transferred it to their wallet. Which means they generated the coins out of thin air. It is expected that Binance will identify the “falsely generated coins” and freeze them.
This doesn’t mean investors didn’t suffer, as generating a huge amount of coins on a chain means it diluted the value of all the other legitimate coins on the chain.
Ultimately stealing a little bit from everyone.
The official account of BNB Chain has informed that with the help of the community, USD 7M has already been frozen.
The technicalities of the Binance Smart Chain hack
When we compare the BNB hacker’s transactions with legit withdrawals, we notice that the height used by the attacker was always the same number – 110217401.
FYI, block height refers to a specific location in a blockchain, measured by how many confirmed blocks precede it.
But, the heights used by legitimate withdrawals, however, were much bigger i.e. 270822321.
Additionally, even the proof of the attacker was significantly shorter than the legit withdrawal’s proofs. These two facts suggest that the attacker found a way to forge proofs for a specific block. In this case, block 110217401.
How IAVL tree is relevant to the BNB hack
Binance uses a special precompile contract used to verify IAVL trees.
But wait, what are IAVL trees? It’s a vast concept but let us understand what is important for this hack.
IAVL tree is derived from the AVL tree, short for Adelson-Velsky and Landis, its founders. The “I” in IAVL stands for “immutable”, which means simply unchangeable.
Simply put, an AVL tree is a mathematical formula that allows the organization of information bundles in an efficient way. It’s mathematically self-balancing which means it can move those information bundles around to be more efficient while continuing to reference the data correctly.
So…
While verifying an IAVL tree you provide a set of “operations”. Typically the Binance Bridge Chain expects two operations: “iavl:v” operation and “multistore” operation. Check this GitHub repo for more information.
It’s understandable, since Binance required us to verify 2 operations. In order to forge any proof, we need them both to succeed and the last operation (multi store operation) needs to return the hash of the specified blocks.
So what seems to be the case is that the attacker took legitimate proof and modified it such that:
- It added a new leaf to the forged payload
- Added a blank inner node to satisfy the prover
- And tweak the leaf to exit early with the correct root hash
Based on my research, that has probably been the method used for the hack.
In summary, there was a bug in the way that Binance Bridge was verifying proofs, which probably allowed hackers to forge random messages.
Fortunately, the hacker forged only two messages, as shown above, and thankfully the community worked promptly to secure the BNB chain, otherwise, the damage could have been far worse.
Do you have BNB tokens? Did this hack affect you and others? Share this on your socials with your comments.