BNB Chain executes hard fork to secure network after $100 million hack

BNB Chain has finished a hard fork upgrade called Moran in an attempt to recover and secure infrastructure following a large hack last week.

The hard fork — a blockchain upgrade that implements a major change to the network's underlying software — went through successfully at 4 a.m. ET on Wednesday at a block height of 22,107,423. It was mainly executed to implement a software patch that resolved a critical vulnerability exploited by an unknown attacker to steal more than $100 million from BNB Chain's cross-chain bridge last Friday.

The developer team announced the upgrade with a GitHub post on Tuesday, saying it would carry out a hard fork to deploy a patch and re-enable the network's “cross-chain infrastructure.”

This cross-chain bridge allows users to transfer assets between the two separate blockchains that fall under the BNB Chain network: Beacon Chain and Smart Chain. While BNB Beacon Chain handles the network's governance and staking, the Smart Chain is used as an Ethereum Virtual Machine-compatible smart contract platform to deploy apps. Both of these chains can connect to other third-party chains with the help of Token Hub bridge as well.

During the exploit, the perpetrator forged security proofs, leveraging a vulnerability tied to "iavl hash check," a security check baked into the bridge. In this way, the hacker was able to mint 2 million BNB tokens out of thin air, worth around $560 million at the time. On-chain data shows that the hacker transferred more than $100 million out to third-party chains including Ethereum, Fantom, Polygon, Avalanche and Arbitrum. The majority of the affected assets (nearly $430 million) remained in the hacker's wallet on the BNB Chain itself. 

In response to the exploit, the team halted the blockchain, ordering all of its 44 validators — including 26 active validators — to stop operations. The team re-enabled the network later but the bridge itself remained shut until the vulnerability could be fixed. The halt was also an effort to stop the attacker in their tracks and salvage any exploited funds that the attacker had not yet moved out to other chains. 

The latest hard fork today will help BNB Chain restart the bridge's full operations and secure the network's overall infrastructure. With this hard fork, the team is expected to move to its next plan of action, which is to conduct governance votes to decide whether to freeze funds held in the hacker’s address on BNB Chain and "auto-burn" them, according to a recent post from the team.