What happened
On September 19, 2021, an attacker exploited pNetwork’s pBTC-on-BSC bridge and removed 277 BTC, valued at about $12.7 million at the time. The incident was confined to the pBTC bridge on BNB Smart Chain, not every pTokens bridge. pNetwork’s post-mortem describes an event-parsing flaw in the node software that allowed crafted peg-out activity to be processed as valid bridge withdrawals.
Bridge node event extraction accepted maliciously crafted peg-out log sequences as valid withdrawal requests. Cross-chain relayers must validate event origin, event type, ordering, and the complete semantic preconditions for a withdrawal; parsing a log successfully is not proof that it represents an authorized bridge action.
Case & protocol details
Attack Timeline
The attacker funded a BNB Smart Chain address, deployed contracts containing malicious logic, and submitted peg-out activity designed to produce both legitimate-looking and faulty event logs. The Rust component of the pNetwork node software that extracted bridge events processed both kinds of logs instead of rejecting the malformed path. That caused the pBTC-on-BSC bridge to honor withdrawals that should not have passed validation.
The attacker then moved the released BTC through identified Bitcoin addresses. pNetwork stopped the exploit, identified the withdrawal addresses, and notified exchanges, but the available post-mortem does not establish a completed recovery amount.
Security review history
- Cryptonics Consulting Report
Evidence & learning
Sources and on-chain records
- report Post-mortem medium.com
- report Report finance.yahoo.com
- report Report cointelegraph.com
- transaction Transaction bscscan.com
- transaction Transaction bscscan.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.