An exploit in the BSC Token Hub cross-chain bridge caused BNB Chain to pause late Thursday after an attacker nearly made off with $500 million worth of BNB. User funds remained safe as the attacker did not steal existing $BNB and instead created new tokens through an exploit.

2 million BNB tokens were initially targeted by the attacker when they exploited the BNB Beacon Chain (BEP2) to BNB Chain (BEP20) bridge to create and then send themselves 1 million BNB twice.

The attacker evidently didn’t move the tokens off-chain fast enough, however, as BNB Chain froze all activity before the bulk of the tokens could be moved. Reports from researchers indicate that the attack began just after 6:30pm UTC.

Initial estimates are that somewhere between $100 to $110 million worth of tokens were moved to Ethereum, Avalanche, Fantom, and other chains, while about $400 million remained on BSC. BNB Chain updated the community saying that out of this sum, around $7 million had been successfully frozen.

The hacker poorly executed the attack according to reports from community researchers on Twitter.

The price of $BNB was impacted quickly by the attack, dropping by nearly 5% from $294 to $280 USD before recovering slightly to $286 as of writing.

BSC News is closely monitoring this situation and will be providing updates as more information is revealed.