Binance Bridge 🌉 Bridge

On October 6–7, 2022, an attacker exploited the BSC Token Hub — the native cross-chain bridge connecting BNB Beacon Chain (BEP2) to BNB Smart Chain (BEP20) — to mint roughly 2 million BNB, worth an estimated $570 million at the time, in two transactions to a single address. Binance Chain validators halted the network within about 90 minutes, before most of the funds could move further. The root cause was a verification flaw in the bridge's proof-checking library, not a stolen key or a drained liquidity pool.

How the attack worked

The Token Hub verifies cross-chain transfers with cryptographic proofs built on IAVL, a Merkle-tree structure used across the Cosmos SDK ecosystem. A valid proof traces a path from a leaf to the tree's root, and at every step along that path a node should carry data on only one side — left or right — never both. According to Halborn's analysis, the bridge's validation code never enforced that restriction. That let the attacker insert forged data into the unused side of a node without changing the path calculation or the final root hash the bridge checked — the tampered proof still verified as authentic.

Using this flaw, the attacker crafted a proof referencing block 110,217,401 — confirmed roughly two years earlier — and used it to fabricate a deposit message the bridge had never actually processed. Submitted directly, the forged proof told BSC that BNB had been locked on the Beacon Chain side, so the Token Hub minted an equivalent amount on BSC with no real collateral behind it. The trick was repeated twice, minting about 1 million BNB each time.

Our database labels this a "Proof Verifier Bug" under Protocol Logic, which matches what happened — though the more specific technical description used by researchers is an IAVL Merkle-proof verification flaw. The Cosmos SDK team later named this bug class Dragonberry once they realized it affected every Cosmos chain using IBC, not just BNB Chain's fork of the library.

What happened after

Binance co-founder Changpeng Zhao asked validators to pause the chain, and within roughly 90 minutes 26 of 44 validators complied, freezing an estimated $430 million still sitting on the BSC address before it could move further. Tether and Circle blacklisted stablecoins the attacker had already swapped into, freezing a further sum reported between $7 million and $33.5 million depending on the snapshot. An estimated $127 million had already crossed to Ethereum, Fantom, Avalanche and Polygon before the halt, some of it posted as collateral on lending markets Venus and BankerJoe to borrow further stablecoins.

The chain resumed after a hotfix, and BNB Chain governance passed proposals to freeze the attacker's remaining BSC-side balance, cover part of the shortfall from the BNB Auto-Burn reserve, and stand up a $1-million-per-bug whitehat program plus a bounty of up to 10% of recovered funds for information identifying the attacker, according to the BNB Chain team's own account. No negotiated return followed. The frozen funds remain frozen in place — on the halted BSC address and in blacklisted stablecoin balances — rather than returned to the protocol or its users, and no arrests have been publicly confirmed.

What this means

• The exploit didn't touch a private key, an oracle, or a liquidity pool — it broke the mathematical assumption a proof-verification library relied on, a failure mode any bridge built on the same code path inherits.
• A single validation bug in a shared library (IAVL) turned into an ecosystem-wide vulnerability once Cosmos SDK maintainers checked other chains for the same flaw — bridge risk isn't limited to the chain that reported the hack.
• Recovery depended entirely on validators being reachable and willing to halt a live chain within minutes; a bridge with fewer, slower, or less coordinated validators would have let more funds escape before any freeze was possible.
• "Frozen" is not "returned": most of the value attributed to this incident is stuck rather than restored, and users of protocols exposed to the drained BNB (like Venus, where the attacker borrowed against deposited BNB) absorbed second-order risk unrelated to the bridge itself.