Audit log

Every state-changing event for Binance Bridge: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-20 18:44:18Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 421,042,212

   sig

   cGCBPWA5A8LC…BJYaPSsQcopyexplorer ↗

   hash

   5zuDXojHro7n…3VtbZVtRcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6540 B) ▸

   {"actor":"system:backfill","investigation_id":"6ea1ef2c-9ad2-458f-9bb3-88ec2da9e58b","kind":"publish","page_slug":"binance-bridge","published_at":"2026-05-20T18:44:18.076Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Binance Bridge","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-bnb-chain-hack-october-2022"},{"credibility":3,"name":"","type":"other","url":"https://en.wikipedia.org/wiki/BNB_Smart_Chain_(blockchain_platform)"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://rekt.news/bnb-bridge-rekt"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-bnb-chain-hack-october-2022"},{"credibility":3,"name":"","type":"other","url":"https://medium.com/immunefi/hack-analysis-binance-bridge-october-2022-2876d39247c1"},{"credibility":3,"name":"","type":"other","url":"https://swarm.ptsecurity.com/binance-smart-chain-token-bridge-hack/"},{"credibility":3,"name":"","type":"other","url":"https://forum.cosmos.network/t/cosmos-sdk-ibc-vulnerability-retrospective-security-advisories-dragonberry-and-elderflower-october-2022/8735"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://bscscan.com/address/0x489a8756c18c0b8b24ec2a2b9ff3d4d447f79bec"},{"credibility":3,"name":"","type":"other","url":"https://www.elliptic.co/blog/analysis/attack-mints-569-million-worth-of-bnb-tokens-in-bsc-bridge-exploit"},{"credibility":3,"name":"","type":"other","url":"https://www.merklescience.com/blog/hack-track-analysis-of-the-bnb-smart-chain-exploit"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/bnb-chain-confirms-bsc-halt-due-to-potential-exploit"},{"credibility":3,"name":"","type":"other","url":"https://fortune.com/crypto/2022/10/06/binance-smart-chain-halts-after-exploit/"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2022/10/06/binance-linked-bnb-price-falls-close-to-4-on-hack-rumors"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.elliptic.co/blog/analysis/attack-mints-569-million-worth-of-bnb-tokens-in-bsc-bridge-exploit"},{"credibility":3,"name":"","type":"other","url":"https://www.bankinfosecurity.com/binance-restores-cross-chain-bridge-after-569m-attack-a-20227"},{"credibility":3,"name":"","type":"other","url":"https://www.binance.com/en/feed/post/1452535182522"},{"credibility":3,"name":"","type":"other","url":"https://cryptoslate.com/binance-resumes-bsc-bridge-operation-after-2m-bnb-exploit/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-bnb-chain-hack-october-2022"},{"credibility":3,"name":"","type":"other","url":"https://www.cnbc.com/2022/10/07/more-than-100-million-worth-of-binances-bnb-token-stolen-in-another-major-crypto-hack.html"},{"credibility":3,"name":"","type":"other","url":"https://techcrunch.com/2022/10/07/blockchain-bridge-hack/"},{"credibility":3,"name":"","type":"other","url":"https://forum.cosmos.network/t/cosmos-sdk-ibc-vulnerability-retrospective-security-advisories-dragonberry-and-elderflower-october-2022/8735"}]}],"sources_used":[],"summary":"Binance Bridge (BSC Token Hub) was the official cross-chain bridge connecting the BNB Beacon Chain (BEP2) and BNB Smart Chain (BEP20), operated by Binance. On October 6-7, 2022, an attacker exploited a critical flaw in the bridge's IAVL Merkle proof verification logic inherited from Cosmos SDK, forging deposit proofs to mint 2 million BNB (approximately $586 million at time of exploit). Although the BNB Chain was halted by validators to contain the damage — trapping roughly $430 million on-chain — approximately $110–137 million escaped to other networks before the halt took effect.","timeline":[{"date":"2019-01-01","event":"Binance launches bridge infrastructure connecting Binance Chain and BNB Smart Chain ecosystems.","source":""},{"date":"2020-09-01","event":"BNB Smart Chain (BSC) launches; BSC Token Hub becomes primary cross-chain bridge for the BNB ecosystem.","source":""},{"date":"2022-10-06","event":"At 18:26 UTC, attacker mints first 1 million BNB via forged IAVL Merkle proof from block 110217401 to address 0x489A8756C18C0b8B24EC2a2b9FF3D4d447F79BEc. Transaction hash: 0xebf83628ba893d35b496121fb8201666b8e09f3cbadf0e269162baa72efe3b8b.","source":""},{"date":"2022-10-06","event":"At 20:43 UTC, attacker mints second 1 million BNB via second forged proof. Transaction hash: 0x05356fd06ce56a9ec5b4eaf9c075abd740cae4c21eab1676440ab5cd2fe5c57a. Total minted: 2 million BNB (~$586M).","source":""},{"date":"2022-10-06","event":"Attacker deposits 900,000 BNB as collateral on Venus Protocol and borrows approximately $147.5M in stablecoins (USDT, USDC, BUSD).","source":""},{"date":"2022-10-06","event":"Attacker bridges stolen stablecoins to Ethereum (~$53M), Fantom (~$57M), Polygon (~$400K), Avalanche, Optimism, and Arbitrum via Stargate Finance and Multichain.","source":""},{"date":"2022-10-06","event":"At approximately 21:35 UTC, all 44 BNB Smart Chain validators coordinate to halt BSC, trapping ~$430M in assets on-chain. Chain halted for approximately 8 hours.","source":""},{"date":"2022-10-07","event":"Binance CEO Changpeng Zhao (CZ) publicly confirms the exploit and chain halt. Tether and Circle freeze combined $33.5M in USDT and USDC held by the attacker.","source":""},{"date":"2022-10-07","event":"Binance restores cross-chain bridge operations after validators apply hotfix release v1.1.15 patching the IAVL verification flaw.","source":""},{"date":"2022-10-08","event":"Cosmos engineers begin intensive security review of ICS-23 implementation in response to the BSC incident, identifying the broader 'Dragonberry' vulnerability affecting all IBC-enabled Cosmos chains.","source":""},{"date":"2022-10-12","event":"BNB Chain implements Moran Hardfork with permanent IAVL hash-check vulnerability fix.","source":""},{"date":"2023-11-01","event":"BNB Chain Core proposes forced liquidation of exploiter's Venus Protocol collateral position. USDT and USDC positions force-liquidated to recover partial funds without open-market BNB sell-off.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 946e5276-91c1-4477-a323-717f9f718c0ecopy
2. #2reviewby reviewerreviewer

   2026-11-02 04:17:34Z
   Score: 10 → 10 (no score change)
   The core narrative holds: the October 2022 IAVL proof forgery, the mint of about 2M BNB, the chain halt, the Venus borrowing and the v1.1.15 hotfix are consistent with the sources I could read. The page has internal inconsistencies: 44 vs 21 validators, 900,000 vs 630,240 BNB on Venus, and a 90-minute interval that its own timestamps put at about 52 minutes. The claim that the hack ranks second only to Ronin is probably overstated, and the Venus liquidation timing looks off. It also omits the 2024 sunset of the BNB Beacon Chain bridge. Many specifics were not checked against the primary sources.
   anchoranchored

   chain

   ●mainnet-betaslot 464,357,934

   sig

   3Jyy2JPJeXLR…S3eyhqLTcopyexplorer ↗

   hash

   EC65c9ve8otr…2uem6wPJcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1454 B) ▸

   {"actor":"reviewer","artifact_identity":"0b748ddf6a79a8aaba3eabf1f769c6b3","decided_at":"2026-11-02T04:17:33.961Z","decision":"review","disputed_pct":0.125,"findings_hash":"A7skR37ssec9DjN7cyY3BDkG2RCEzS5nGDQ1SpULN4N7","investigation_id":"6ea1ef2c-9ad2-458f-9bb3-88ec2da9e58b","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":10,"omissions":{"material":1,"total":1},"page_content_hash":"38bc668dda9d98e71403b0eeafbb1fe098fbdafcf125bf06c60c1a45c81f36bb","page_slug":"binance-bridge","prev_score":10,"reason":"The core narrative holds: the October 2022 IAVL proof forgery, the mint of about 2M BNB, the chain halt, the Venus borrowing and the v1.1.15 hotfix are consistent with the sources I could read. The page has internal inconsistencies: 44 vs 21 validators, 900,000 vs 630,240 BNB on Venus, and a 90-minute interval that its own timestamps put at about 52 minutes. The claim that the hack ranks second only to Ronin is probably overstated, and the Venus liquidation timing looks off. It also omits the 2024 sunset of the BNB Beacon Chain bridge. Many specifics were not checked against the primary sources.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":2,"subject_status":"rebranded","subject_status_contradicts_page":true,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 417353f6-3f8a-48a8-984f-200c84d34cfecopy
3. #3review reviseby judgejudge

   2026-11-02 04:17:34Z
   Score: 10 → 0 (-15)
   The core account of the October 2022 exploit (forged IAVL proofs, about 2M BNB minted, chain halt, v1.1.15 hotfix) is consistent with the sources the reviewer could read (claim_findings[0], [6]). The page contradicts itself on the validator count (44 vs 21, claim_findings[3]), the Venus collateral (900,000 vs 630,240 BNB, claim_findings[1]) and the halt interval (90 minutes vs about 52 by its own timestamps, claim_findings[4]). The 'second only to Ronin' ranking and the Venus liquidation date are also questioned (claim_findings[2], [5]). The page omits the 2024 sunset of the BNB Beacon Chain bridge, a material omission with a high-priority coverage gap, and many per-transaction details were not checked against primary sources (claim_findings[7]).
   anchoranchored

   chain

   ●mainnet-betaslot 464,357,938

   sig

   N9AKYq7VQgj7…tyrQvvN1copyexplorer ↗

   hash

   FqvuAa9QuVM1…ukKsXo7Kcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1995 B) ▸

   {"actor":"judge","artifact_identity":"0b748ddf6a79a8aaba3eabf1f769c6b3","band_override":null,"decided_at":"2026-11-02T04:17:33.961Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.125,"investigation_id":"6ea1ef2c-9ad2-458f-9bb3-88ec2da9e58b","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":0,"page_slug":"binance-bridge","prev_score":10,"reason":"The core account of the October 2022 exploit (forged IAVL proofs, about 2M BNB minted, chain halt, v1.1.15 hotfix) is consistent with the sources the reviewer could read (claim_findings[0], [6]). The page contradicts itself on the validator count (44 vs 21, claim_findings[3]), the Venus collateral (900,000 vs 630,240 BNB, claim_findings[1]) and the halt interval (90 minutes vs about 52 by its own timestamps, claim_findings[4]). The 'second only to Ronin' ranking and the Venus liquidation date are also questioned (claim_findings[2], [5]). The page omits the 2024 sunset of the BNB Beacon Chain bridge, a material omission with a high-priority coverage gap, and many per-transaction details were not checked against primary sources (claim_findings[7]).","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":-15,"sequence_num":3,"severity_override":{"applied":true,"band":"significant","from_band":"minor","reason":"The percentage alone (1 of 8 claims unverifiable, 12.5%) implies the minor band. The review also reports a material omission and says the page contradicts the subject's current status: the BNB Beacon Chain, one end of the bridge, was sunset in 2024 and the page does not say so. Four further claims are only partially supported because the page contradicts itself. The penalty is kept at the low end of the band because the reviewer's confidence is 0.5 and the status finding rests on search snippets."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 759420eb-b3fd-412d-b011-a8c7cf726773copy