What happened
On September 19, 2021, an attacker drained 277 BTC, most of the collateral behind pBTC on BNB Smart Chain, from pNetwork's pBTC-on-BSC bridge. Reported values range from about $12.4 million to over $13 million. The bug sat in pNetwork's off-chain Rust code that read peg-out event logs from BSC: it did not check that a peg-out event was emitted by pNetwork's own contract, so events from the attacker's contracts were treated as genuine withdrawal requests.
pNetwork said its other bridges were not affected, paused and patched the bridge, and offered a $1.5 million bounty for the return of the funds.
Bridge node event extraction accepted maliciously crafted peg-out log sequences as valid withdrawal requests. Cross-chain relayers must validate event origin, event type, ordering, and the complete semantic preconditions for a withdrawal; parsing a log successfully is not proof that it represents an authorized bridge action.
How it happened
- pNetwork's bridge released BTC on the Bitcoin side when its nodes saw a peg-out (redeem) event for pBTC in a BSC transaction's logs.
- The attacker deployed contracts that emitted events shaped like pNetwork peg-out requests, alongside a legitimate peg-out in the same transaction.
- The Rust log-processing code collected every matching event in the receipt without checking which contract address emitted it.
- The bridge treated the spoofed events as real redemptions and released BTC from the pBTC-on-BSC collateral to the attacker, 277 BTC in total.
Protocol details
Security review history
- Cryptonics Consulting View report
Evidence
- report pNetwork post-mortem: pBTC-on-BSC exploit medium.com
- report Cointelegraph report on pNetwork pBTC bridge incident cointelegraph.com
- transaction BscScan first exploit transaction bscscan.com
- transaction BscScan attacker funding transaction bscscan.com
- analysis Explained: The pNetwork Hack (September 2021) halborn.com
- analysis Website reference finance.yahoo.com
- analysis DeFiLlama defillama.com
- analysis $12.4M Lost as DeFi Platform pNetwork Suffers Exploit cryptobriefing.com
- analysis Hacker Makes Off with $12 Million in Latest DeFi Breach govinfosecurity.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
