Binance Crypto Exchange Hacked for $567 Million in Latest Attack Against Decentralized Finance Binance suffered a vulnerability in one of its "cross-chain bridges," and had isolated losses to less than $100 million within a day, the company said Friday.
Opinions expressed by BIZ Experiences contributors are their own.
On Thursday evening, crypto exchange Binance was hacked, and thieves were able to snatch about $567 million, the company said in a blog post on Friday.
"First, we want to apologize to the community for the exploit that occurred. We own this," it wrote.
The news broke on Twitter when Binance CEO Changpeng "CZ" Zhao Tweeted there had been an "exploit."
An exploit on a cross-chain bridge, BSC Token Hub, resulted in extra BNB. We have asked all validators to temporarily suspend BSC. The issue is contained now. Your funds are safe. We apologize for the inconvenience and will provide further updates accordingly.
— CZ Binance (@cz_binance) October 6, 2022
Binance is a cryptocurrency exchange. People can use it to trade different types of digital currencies. The platform also has its own cryptocurrency (which is referred to as a "native coin") called "BNB."
You can use it to buy things outside of the Binance ecosystem, but one of its main uses is paying transaction fees on the platform more efficiently.
In the hack, 2 million BNB were stolen, or about $567 million in USD as of this morning, though the coin's value did drop on the hack news.
Thursday's attack is the latest in a string of crypto hacks this year. One analysis said these attacks are up 58% year over year and that $1.9 billion in crypto has been stolen as of July 2021 — with many of the attacks linked to North Korean groups, per Bloomberg.
In this case, the hackers took advantage of a vulnerability in what is called one of the Binance ecosystem's "cross-chain bridges."
This is how you move crypto across the blockchain and thus from one currency to another. They are overseen by various stakeholders including "validators."
According to Zhao, these validators rallied across various time zones to stop the hack before he had even woken up around 3 a.m. his time:
Full transparency, I was asleep (yes, I sleep). By the time I was woken up at 3AM, the community of validators had already paused. I just did the tweeting. The community & team did all the work. https://t.co/m4PQ3tMIZB
— CZ Binance (@cz_binance) October 7, 2022
The company said it moved quickly to keep the funds from being withdrawn through various means, froze $7 million worth of the funds off the bat, and then had isolated losses to less than $100 million, Zhao told CNBC Friday morning.
Going forward, per the company blog post, Binance plans to take votes on introducing additional security measures and offering $1 million for each "significant bug" discovered in the system, as well as what to do with the hacked funds.
As for catching the people who did it, as Zhao explained on CNBC, the blockchain is "pseudo-anonymous," but there are firms who can attempt to find out who did it.
"It's not 100% guaranteed," he said, "but it can be traced to a fairly large degree."
