BNB Chain hard-forked after Token Hub exploit withdrew 2 million BNB

BNB Chain disclosed on October 7, 2022 that an exploit of its BSC Token Hub cross-chain bridge had enabled the withdrawal of 2 million BNB. The organization coordinated a temporary halt of BNB Smart Chain and released client version 1.1.15, an emergency hard fork designed to block identified attacker accounts and suspend the bridge-related precompiled contracts.

The response contained the incident, but it also exposed two distinct risks. The first was technical: a forged proof had been accepted by infrastructure connecting BNB Beacon Chain and BNB Smart Chain. The second was institutional: stopping the chain required direct coordination with a relatively small validator set, raising immediate questions about operational control and decentralization.

What BNB Chain verified

BNB Chain’s October 7 account identified the affected system as BSC Token Hub, the native bridge between BNB Beacon Chain, then associated with BEP2 assets, and BNB Smart Chain, associated with BEP20 assets. It said 2 million BNB had been withdrawn through what it described as sophisticated forgery of a low-level proof in a shared library.

The organization said it contacted validators individually to prevent the incident from spreading. Its disclosure counted 26 active validators and 44 validators in total across different time zones. Those figures came from BNB Chain and describe its stated validator configuration on October 7; they are not an independent measurement of how many parties exercised effective control.

Reuters reported that the chain resumed operation at approximately 06:30 GMT on October 7 after being suspended for several hours. Resumption of block production did not mean the affected bridge had returned to normal operation. The version 1.1.15 release instructed every client to upgrade and expressly stopped transfers between BNB Beacon Chain and BNB Smart Chain.

The emergency hard fork

The public software record supplies unusually direct evidence of the response. BNB Chain’s GitHub release designated block 21,962,149 as the hard-fork height. Its accompanying change suspended cross-chain bridge precompiled contracts and prohibited transactions involving specified accounts associated with the exploit.

That distinction matters. The release did not establish that every unit of the nominal amount had left BNB Smart Chain or become an economic loss. It changed consensus rules to restrict movement, disabled the affected cross-chain path and required node operators to run the new software if they wanted to remain compatible with the post-fork chain.

The episode therefore demonstrated both the usefulness and the governance cost of emergency coordination. Validators could react quickly enough to limit asset movement, but doing so required intervention at the network and client-software levels rather than an automatic recovery mechanism.

Interpreting the dollar figures

Reuters valued 2 million BNB at approximately $570 million in its October 7 report. That figure implies about $285 per BNB, but Reuters did not specify a trading venue, currency pair or exact observation timestamp. It should therefore be treated as a contemporaneous nominal valuation, not an official closing price or a measure of realized loss.

A Binance spokesperson separately told Reuters that approximately $100 million was unrecovered, while blockchain-analysis firm Elliptic said the attacker had minted the BNB and converted part of it into other assets. Those were contemporaneous attributed assessments, not final accounting. The larger $570 million figure represented the reported quantity of BNB created or withdrawn; the smaller estimate concerned assets believed to have escaped immediate control.

Why the incident mattered

The exploit arrived during an established wave of attacks against cross-chain infrastructure. On August 2, 2022, Chainalysis estimated that $2 billion had been stolen through 13 bridge hacks, with most of that value lost during 2022. Its estimate predated the BSC Token Hub incident and therefore describes the risk environment entering October, not a total that includes this event.

As of October 7, the defensible conclusion was limited but significant: BNB Chain had confirmed a critical bridge failure, validators had interrupted chain operation, and an emergency hard fork had restricted attacker accounts while cross-chain transfers remained suspended. The ultimate recovery, governance decisions and complete technical postmortem were still unresolved.