As anonymous and secure cryptocurrency transactions are, the exchanges that conduct transactions and manage accounts are not that anonymous. The latest hacks is of Binance BNB Cryptocurrency worth $570 million. There were over 40 breaches at cryptocurrency exchanges recorded in 2021 with losses over $30 billion US dollars. This year, there have been at least 6 exchange breaches so far totaling almost $1 billion in losses. One of them is Ronin Network Heist back in March 2022. These incidents expose Crypto Vulnerabilities. While the scale of the breaches was not that different from last year, the fall in cryptocurrency values this year makes the monetary losses look smaller.
The Ronin Network Hack worth over $600 million
Many of the heists, including the second biggest theft to date (over US$600M) at the Ronin Network, may have been complicated by nature, but they all were facilitated by something simple: the theft of private keys. The private keys were stolen from accounts usually using reused credentials stolen from other sites. The Ronin Network heist using private keys was more interesting.
The Ronin Network manages transactions related to gaming NFTs (non-fungible tokens) or more commonly known as virtual assets (such as pets) within online gaming. To ensure security of online transactions Ronin has eight (8) validator nodes where at least five (5) of the nodes must verify the transaction is valid. Each validator node has its own private keys. Four of the nodes belonging to Sky Mavis, the company that runs the Axie Infinity game, were hacked because security was loosened during a game promotion in Dec 2021 due to heavy player load but never reenabled. From there, hackers were able to gain access to a fifth validator node allowing them to approve any fraudulent transactions. The heist was discovered when a player could not withdraw any cryptocurrency from their account and filed a support request.
The Binance Hack worth $570 million - Technically Explained
The most recent and even more interesting cryptocurrency heist happened this past week at Binance, the largest cryptocurrency exchange and, ironically, one of the exchanges that froze transactions during investigation of the Ronin heist. In addition to being an exchange, Binance created its own currency called BNB, the 5th largest cryptocurrency by market capitalization. But here is the twist; in this theft, coins or tokens were not stolen. Instead, hackers were able to exploit a flaw in the BNB blockchain allowing them to mint or create 2 million BNB tokens with an estimated worth of US$570 million. Think of this as a forger sneaking into a country’s central bank or currency mint one night, printing real money and leaving with it.
Then things fell apart for the hackers. They tried to convert some of the 2 million tokens quickly into other cryptocurrencies and attracted attention doing it. While some US$53 million was gained converting BNB to decentralized Ethereum, tokens were converted into other currencies where the exchange transactions were more tightly controlled and could be blocked quickly. This allowed Binance to stop all transactions at its 44 validators globally, effectively freezing any BNB transaction until the heist could be investigated. Binance has since restarted processing transactions once it was determined that no customer accounts were compromised or lost any assets. The company is also implementing new security upgrades to prevent this from happening again. Most of the falsely minted tokens have not been recovered and are presumed to be stored offline. Binance claims only US$100 million was lost in this hack. It is not clear if transactions using these tokens will be detected and blocked in the future.
For those technically minded, the heist was conducted by exploiting a flaw in the BNB blockchain at a connection point called a “bridge” where transactions are converted from one blockchain system to another. Think of this as sending money in dollars from the United States to Germany and the money is automatically converted into Euros at the connection between both countries. Once the bridge was controlled, using its private key one (1) million new tokens were created then transferred to the hacker account. A second transaction creating another 1 million new tokens and moving them was processed shortly after.
