The largest cryptocurrency exchange in the world, Binance, reported on Friday that scammers had stolen cryptocurrency worth about $100 million.
The entire amount taken was $580 million, but according to firm chief Changpeng Zhao, over 80% of it had been instantly frozen, and the harm was just about $100 million.
The exchange's designated currency, BNB, was produced more than necessary due to "an exploit" in the system, he said in a tweet, but he asserted the problem had been "controlled" and assured his seven million followers that "your monies are safe."
It ranks among the largest thefts in the history of cryptocurrencies and occurs during a year in which criminals who prey on the industry have made off with billions of dollars.
In the most damaging incident, the Axie Infinity blockchain game was hacked for more than $500 million in late March.
Both scams exploited weaknesses in “cross-chain bridges” — the means used by investors to move assets from one blockchain to another.
Blockchains are digital ledgers that store details of transactions — the biggest is bitcoin but there are thousands of others.
Binance, which dominates the sector and boasted of handling transactions worth $32 trillion last year, said in a statement that “a total of 2 million BNB was withdrawn”, which valued the heist at $580 million.
Zhao later clarified in an interview with MSNBC that most of those coins had been frozen.
– ‘Complete chaos’ –
Prominent crypto figures had taken to social media late on Thursday talking of a $600 million theft hours before the firm sent its first statement.“Somebody on BNB just got hacked for (roughly) 2 million BNB,” wrote a developer who uses the name foobar on Twitter.
“The attacker is spewing funds across liquidity pools and utilising every bridge they can to get to safer chains. Complete chaos on the chain.”
Experts have been warning of security lapses on cross-chain bridges all year.
Chainalysis, a crypto analysis firm, said in August that bridge exploits had accounted for around $2 billion in thefts this year already.
Elliptic, another analysis firm, said in a report this week that bridges “tend to accumulate large amounts of locked assets on numerous blockchains, many of which may not have advanced security or auditing cultures due to their relative obscurity”.
“This has made bridges an attractive target for cybercriminals in the past,” it added.
Governments around the world are concerned that cryptocurrencies are being used to fund terrorism, circumvent sanctions and prop up repressive regimes.
Experts believe groups linked to North Korea have been behind some of the most high-profile heists, including the Axie Infinity breach.