ChangeNOW on the BNB Smart Chain Hack

ChangeNOW, an instant crypto exchange service, shares the internal review of the incident on the Binance Smart Chain hack.

As reported by the SlowMist blockchain security firm on Oct. 7, the initial funds for the BNB Smart Chain attack came through the instant crypto exchange service ChangeNOW. 

The hacker performed a double spending attack and stole 2 million BNB from the BSC Token Hub bridge, consequently trying to launder over half a billion dollars. Such protocols as Uniswap, SushiSwap, PancakeSwap, Alpaca Finance, and Curve Finance were also used by the attacker to move crypto before the hack, in addition to ChangeNOW.io. 

Here are the results of an internal investigation that ChangeNOW instant exchange service conducted following the hack. 

ChangeNOW Reviews the Situation

The funds that SlowMist mentions in its report were swapped through ChangeNOW before the BSC hack. As the sender address had never been involved in fraud, ChangeNOW's AML system confirmed the exchange.  

The swap was completed, and the funds went to the recipient wallet - a newly created address with a clean transaction history. As soon as ChangeNOW learned about the hack, it immediately blocked this address.

BNB Smart Chain Hack: Chain of Events

After exchanging coins on ChangeNOW, attackers directed the funds to BSC Token Hub - a cross-chain bridge that allows swapping assets between BNB Beacon Chain and BNB Smart Chain. They exploited a critical vulnerability that allowed them to carry out a double spending attack. 

Later, hackers sent 2 million BNB to the Venus lending protocol. The service issued a statement where it described two scenarios for the attackers: hackers can refund their loan (and return liquidity to the protocol), or their account will be liquidated in case they disappear with stablecoins they had borrowed. 

Once malicious activity was detected, Binance CEO Changpeng Zhao asked all validators to temporarily suspend BSC. Network operation was resumed later, following a "hot fix and hard fork release." Hackers laundered about $100M worth of BNB. 

ChangeNOW and Customer Protection 

According to ChangeNOW's Corporate Responsibility policy, the service is striving to make the crypto industry a safer place. The platform's AML system and tight cooperation with the community have helped combat cryptocurrency-related crime multiple times and return millions of dollars to fraud victims. 

Changenow.io's review of the BNB Smart Chain hack hints that this case is not an exception - the platform reaffirms it will continue to monitor the situation and is assisting the community and law enforcement to help tackle the consequences of the attack. 

_***

ChangeNOW is a user-friendly platform for instant, limitless, and registration-free cryptocurrency exchange, founded in 2017. Currently, there are almost 1,000 coins available on the platform for exchange. As a non-custodial service it doesn't store users funds.

Website | Twitter | Reddit | YouTube