Binance Security Breach

This post was originally published on May 08, 2019, and sent to Messari Pro subscribers.

Exchanges get hacked. The good ones know how to mitigate the fallout. Every “security incident” reminds the crypto world to keep their funds secure, and at least in the case of yesterday’s apparent $40 million+ bitcoin theft from Binance, customer funds will be made whole via the exchange’s “SAFU” fund (the “secured asset fund for users”), something reserved specifically for an instance like yesterday’s. Binance will be fine…they’ll make that back in about six weeks, and CZ’s crisis communications are second to none. Although the exchange will shut down withdrawals for the next week while they identify the hackers’ exploit and work to enhance their security measures, most of the conversation has gravitated to a last resort that Binance did not take, but considered: attempting a coordinated “chain reorg” - a sort of 51% attack where they could have double spent the illicit transaction on the bitcoin blockchain. Given the magnitude of the hack, it’s a sensible option for them to have explored.

It started with Jeremy Rubin’s tweet:

Since the number of coins hacked (7,000 BTC) vastly exceeds the block-rewards miners receive in a given block (12.5), it would be possible (in theory) to pay miners to undo the hack. An oversimplification:

• Imagine Binance publishes a transaction with a 100 BTC fee to miners *from the hacked coins’ address (the “unspent” transaction outputs, or UTXO).
  
• This transaction would be invalid on the current longest blockchain following the initial hacked transaction because it would be a double-spend of the hacked coins (that belong to the hacker now), BUT this could be rendered moot if the miners who mined the initial transaction and subsequent transactions decided to build off of the block before the hack transaction.