Cointime

Download App
iOS & Android

$6.2 Billion Worth of Binance’s BNB Token “Magically” Appeared Onchain

Validated Individual Expert

TLDR:

  • US$6.2 billion of BNB tokens “magically” appear in a Binance Chain (BNB Beacon Chain) wallet without any transaction reflecting their transfer in.
  • Token movements between the Binance Chain (BNB Beacon Chain) and Binance Smart Chain (BNB Smart Chain) have periodically not had transaction hashes to identify such transfers.
  • Attempts to run a blockchain node on Binance Chain (BNB Beacon Chain) have proved futile as there are “breaks” in the chain every 24 hours.

Bynow, there are serious questions hanging over the “blockchain-ness” of cryptocurrency exchange Binance’s various blockchains (BNB Beacon Chain, BNB Smart Chain), and whether or not they’re really operated as blockchains or somewhat more cynically as nothing more than centralized databases with a veneer of “decentralization.”

In order to make sense of the madness, it’s important to start from the beginning — Binance’s BNB token.

Launched in 2017, Binance’s BNB was intended to have a maximum supply of 200 million, as recorded in its whitepaper, of which 100 million was for the initial coin offering to outside investors, 80 million to the founding team (over a four year vesting period) and 20 million for angel investors.

In 2019, Binance launched the Binance Chain (since renamed to BNB Beacon Chain), which uses the Cosmos SDK and was intended to support decentralized exchanges, primarily Binance’s DEX.

So far so good.

Then in 2020, Binance went ahead with its Binance Smart Chain (since renamed to BNB Smart Chain), an Ethereum clone that could support smart contracts.

The importance of the two Binance chains and their relationship with each other will become apparent shortly.

In mid-December 2022, Twitter user @cryptohippo65 noted that 22 million BNB tokens had “miraculously” appeared in one of the top wallet addresses for the BNB token:

bnb1j725qk29cv4kwpers4addy9x93ukhw7czfkjaj

According to the blockchain explorer, this wallet held some 22 million in BNB tokens, but there’s no evidence of where those tokens came from.

There are only 10 transactions for the wallet address at the time of print and none of them contained 22 million BNB.

For the unfamiliar, a blockchain is supposed to record all the transactions going into or out of a particular wallet address — that’s what makes it special, that you have an unalterable, immutable record of transactions.

From the early days of Bitcoin and blockchain, the idea was that by having a permanent, decentralized and immutable ledger of transactions, us fallible humans would no longer have to argue over what had or had not happened in the past — the code would set us free to pursue more higher order pursuits, such as buying Lambos.

As a decentralized single source of truth, any blockchain address is supposed to reflect whatever went in and whatever went out, except this peculiar address (bnb1j725qk29cv4kwpers4addy9x93ukhw7czfkja) on the Binance Chain (now known as the BNB Beacon Chain).

So how did 22 million BNB make its way into this address (by the way, this isn’t how airdrops work)?

That leaves only two real possibilities (neither of which is mutually exclusive):

  1. None of the Binance Chains operate as actual blockchains, in other words, transactions (and their hash identifiers) can be amended going backwards and the ledger doesn’t provide an immutable source of truth; and/or
  2. The blockchain explorer is faulty, such that the transactions do go through, but the explorer doesn’t reflect them — in other words your tokens can show up, but how they got there isn’t transparent.

@cryptohippo65 did not immediately assume that the Binance blockchains had an issue and instead tried other explorers, which gave rise to the same issue — no trace of 22 million BNB heading into the wallet in question.

So if the problem isn’t with the explorer, then where is it?

Navigating the Binance Ecosystem Where Everything Sounds the Same

A bit of nomenclature clarity is necessary here, otherwise things get very messy, very quickly:

  1. Binance Chain (“BC”) — since renamed as BNB Beacon Chain and operates on the BEP-2 technical standard, and a heavily re-worked version of the Cosmos SDK.
  2. Binance Smart Chain (“BSC”) — since renamed as BNB Smart Chain and operates on the BEP-20 technical standard, a version of Ethereum that has also been modified.
  3. BSC Token Hub — the BSC Token Hub acts as a vault to facilitate cross-chain transactions between BC and BSC and submits the communication between the two blockchains. (E.g. sending BNB from BC to BSC via the BSC Token Hub should leave a trail of breadcrumbs to see that passage and ought to be capable of inspection on an explorer).

For simplicity, this article will only refer to Binance Chain as “BC” and Binance Smart Chain as “BSC” exclusively and ignore the new nomenclature in the interests of clarity.

So technically, if a user were to send BNB from BC to BSC there should be a transaction history of that through the BSC Token Hub, and vice versa the other way around.

In practice of course, that wasn’t the case as revealed by ChainArgos data.

In this transaction 200,000 BNB were transferred to the BSC Token Hub (the bridge) on the BSC side from the address 0x18913656c387613f6d0a1bff7365c335c0069e69 (BEP-20) with the ultimate destination bnb1h9ymecpakr8p8lhchtah2xxx7x4xq099umclqu (BEP-2) on the BC side.

The transaction of 200,000 BNB was marked as successful:

But a quick search of the BC explorer for the address bnb1h9ymecpakr8p8lhchtah2xxx7x4xq099umclqu (BEP-2) shows no evidence of the 200,000 BNB transfer for that date window.

Since ChainArgos started looking more closely at these transactions, some changes have been noted in the classification of transactions and wallet names.

Nonetheless, the gaps are still there.

Every transaction on a blockchain is supposed to have a unique “TxHash” or a one-of-a-kind code which acts as an identifier for that transaction.

In this case, the 200,000 BNB is identified by this TxHash:

CD6948F6A80EC0BC5A87E80A37C70C3A9EDC82CFFEC467C5AEAC187333AB58FD

It’s also reflected as an “Oracle Claim” which will be helpful when trying to find this transaction on the BC explorer, except that it’s not there.

Even looking at transaction data several days before and after December 20, 2020 there isn’t a single TxHash for CD6948F6A80EC0BC5A87E80A37C70C3A9EDC82CFFEC467C5AEAC187333AB58FD

So ChainArgos tried again in the other direction, from BC to BSC with the same result.

Transaction that has been stewed to perfection for over two years still reflects a “pending…” TxHash on BSC.

So maybe it’s just a blockchain explorer limitation?

After all, bridging across chains could cause some things to get unchained (pun intended), but perhaps there is a way to find out if there are any incoming cross-chain transfers coming from the BC side into BSC, except that there isn’t.

To be sure, no one is saying that the transactions between BC and BSC via the BSC Token Hub don’t go through, there just isn’t any way to verify and that much is alluded to by someone claiming to be the “Chief Scientist” for the BNB Chain.

So if, as the “Chief Scientist” suggests, what you see is really not what you get, how is one to figure out what transactions have occurred, by running a node?

Build Your Own Blockchain

While the BSC node is easy enough to setup and run, the way it syncs is something else altogether.

For those new to the business of running a blockchain node, the idea of course is to sync your node from the genesis block so that you have a copy of the same decentralized ledger of transactions that everyone else has going back to the very beginning.

Think of it as coming to a meeting late, and someone updates you of what has transpired up to that point.

The whole idea behind decentralization is that transactions are supposed to be verified independently from the very beginning, yet interestingly enough BNB Chain recommends you “Sync From Snapshot (Recommended)” to run a BSC node.

In fact, BNB Chain discourages you from syncing your node from the genesis block (i.e. the very beginning).

And that’s a big deal because every other properly decentralized blockchain doesn’t just recommend you sync from the genesis block, it’s a requirement.

Take Ethereum for instance, where running a node requires you sync from the genesis block because a validator needs the entire state (i.e. the balances of accounts, the code of contracts, etc.) in order to validate future blocks.

Because that’s how blockchains are supposed to work — you’re supposed to have a full history, not just a page.

It’s the equivalent of trying to study the history of Germany, but only starting in 1946, and pretending that all those years before that were, um, unimportant for context.

Not syncing from the genesis block is akin to a bank tearing up the first half of your bank book and tossing it out but being ok to confirm that you miraculously have a hundred million dollars.

Or like getting a recipe which tells you only what to do after you take it out of the oven (the first part matters too).

To make matters worse, syncing a BSC node using snapshots requires running something called a “pruneancient flag” the nomenclature of which will make sense shortly — that bit of code literally means pruning old transactions, hence “prune-ancient.”

Because, who needs the really old transactions right?

Onwards and upwards.

But as it turns out, these “ancient” transactions really aren’t that ancient anyway.

Syncing a BSC node using snapshots, means that the “validator” only pulls the 90,000 blocks immediately past, whereas older transactions get put into what the cynics who created this chain called a “prunedfreezer.”

But what’s the big deal you may ask?

Well for starters, it means that if someone wanted to bury “interesting” transactions, they could — just wait another 90,000 blocks and they get stuffed into the “prunedfreezer” literally the stuff that gets jammed into cold storage and which no longer go in later snapshots.

On average around 28,400 blocks (give or take) are processed on BSC a day.

Which means that every three and a half days or so, voila, the transactions before that get stuffed in the “prunedfreezer.”

Mind you, these transactions aren’t lost, they’re just really difficult to get to, syncing from snapshots, (sort of like when you really drop food behind the freezer), the only way is to try and sync the node from the genesis block.

Nevertheless, the BSC node can be synced all the way to the genesis block, albeit with some effort.

On to the more interesting Binance-associated blockchain, BC.

A Beacon is Supposed to Guide the Way Surely?

The best way to sync a blockchain is from the beginning, except that any attempt to sync a node from the genesis block on BC throws up this error:

panic: Failed to process committed block (285075852:2BDC391C402FF452B83AD484D5C40DA615133C25E60C07352CBC6E45435EA873): Wrong Block.Header.AppHash. Expected 3E60F1573122DC7FAD2C5E4779A21BFEEB578422C915A16DEA70A1A617314720, got 1EDDADB1DC0B8E67A3F10FCE05201A4A59A7C380EC54F3CA83D400317CC49685

The program basically determines that you can’t handle the truth.

Attempting to sync a node from the genesis block revealed that the blockchain hashes didn’t match.

Suffice to say that there is evidence the BC blockchain breaks every 24 hours but somehow acquires sufficient consensus to keep moving forward.

So where are we at?

Basically we are nowhere closer to finding out how the 22 million BNB appeared in the wallet address:

bnb1j725qk29cv4kwpers4addy9x93ukhw7czfkja

We know that the BNB are there, we just don’t know how they got there, which is more of an existential question.

The wallet in question has since the time this investigation first began, been relabeled as the “Staking Escrow Account” and at the time of writing, is no longer searchable on the BC explorer.

Conclusion

We are no closer than before to finding out what exactly is going on with the various Binance-associated blockchains, and each time we dig, it becomes less and less clear.

If indeed tokens in a BC wallet appeared without any transaction tracing them into that wallet address, then this has ceased becoming a math or programming issue, it’s become a thoroughly human one.

In the meantime, wouldn’t it be great if 22 million BNB just showed up in your wallet?

Binance Chain — What’s in your wallet?

https://patricktan-crypto.medium.com/6-2-billion-worth-of-binances-bnb-token-magically-appeared-onchain-8a5adff9468f

Comments

All Comments

Recommended for you

  • SlowMist: Beware of watering hole attacks launched by malicious attackers using WordPress plugin vulnerabilities

    SlowMist Security has issued a warning that attackers have recently been exploiting vulnerabilities in WordPress plugins to inject malicious JS code into normal websites and launch watering hole attacks. These attacks involve popping up malicious windows when users visit the site, deceiving them into executing malicious code or performing Web3 wallet signatures, thereby stealing their assets. It is recommended that sites using WordPress plugins check for vulnerabilities, update plugins in a timely manner, and avoid being attacked. When visiting any website, users should carefully identify the downloaded programs and Web3 signature content to avoid downloading malicious programs or having their assets stolen due to malicious signatures.

  • Unverified Ember Sword NFT auction contract vulnerability has caused nearly $200,000 in losses

    Certik has discovered a vulnerability in the unverified Ember Sword NFT auction contract, which has earned 60 WETH (approximately $195,000) from 159 victims who approved the contract. Certik reminds users to revoke their approval of the relevant contract on Polygon.

  • zkSync ecological lending platform xBank Finance suspected of RUG

    xBank Finance, a zkSync ecosystem lending platform, was suspected of being a RUG, and the protocol's TVL was close to zero. The project's official Twitter account has been frozen.

  • Scammers use fake USDT balances to defraud cryptocurrency users

    SlowMist has partnered with Imtoken to uncover a new cryptocurrency scam that uses offline transactions and USDT. Scammers manipulate the Ethereum RPC to falsify the USDT balance in the victim's wallet. The scammer lures the victim to change their Ethereum RPC URL to a URL controlled by them, making it appear that the victim has deposited USDT funds, but in reality, the victim is left empty-handed when attempting to trade. In addition, the scam also deceives users through small transfers to gain trust, then manipulates account balances and contract information, posing serious risks to unsuspecting users and is related to a wider range of pig slaughter scam activities.

  • Cointime April 27th News Express

    1. ETH falls below $3,100

  • HKEX: Accepts BOS HashKey, Huaxia, Harvest Bitcoin and Ethereum ETFs as eligible securities for multiple counters in the central clearing system

    On April 27th, the Hong Kong Stock Exchange issued three notices, announcing the inclusion of Bo Shi HashKey Bitcoin ETF shares and Bo Shi HashKey Ethereum ETF shares, Huaxia Bitcoin ETF shares and Huaxia Ethereum ETF shares, and Jia Shi Bitcoin Spot ETF shares and Jia Shi Ethereum Spot ETF shares as Central Clearing System multi-counterparty eligible securities. It is reported that:

  • Russia’s Central Bank and Rosfinmonitoring unveil pilot of fiat-to-crypto tracking system

    According to reports, since 2023, Russia has been trying to track cryptocurrency transactions and their sources. The Russian Central Bank and the Federal Financial Monitoring Service (Rosfinmonitoring) revealed that there is currently a system that allows private banks to track the connection between fiat-based transactions and cryptocurrency business.

  • PolkaWorld: Coretime trading on Kusama has started

    On April 27th, PolkaWorld announced that Coretime trading on Kusama has begun, marking the end of the era of parallel chains. With the approval and implementation of Kusama proposal 373, the proposal will upgrade the Kusama relay chain runtime to v1.2.0 and bring Coretime functionality. Shortly thereafter, the Kusama community approved Kusmaa proposal 375 last Friday, allowing Coretime chain to begin selling Coretime. Currently, Kusama is in the Renew Period and is selling batches of Coretime.

  • Over $155 million worth of MEME will be unlocked on May 3, accounting for 31.96% of the circulating supply

    According to Token Unlocks data, 5.31 billion MEME tokens, worth over $155 million, will be unlocked on May 3, 2024, accounting for 31.96% of the circulating supply. These tokens will be unlocked and distributed to airdrops, advisors, and investors.

  • The total open interest of BTC options is $17.83 billion, and the open interest of ETH options is $8.07 billion.

    Coinglass data shows that the nominal value of unclosed BTC option positions on the entire network is 17.83 billion US dollars, which is the lowest point since February 26; the nominal value of unclosed ETH option positions is 8.07 billion US dollars, which is the lowest point since February 25.