Binance, the leading cryptocurrency exchange, saw its Binance Smart Chain attacked this Monday afternoon. Its DEX, PancakeSwap, announced on Twitter at 3.36pm yesterday that its domain name (DNS) had been hacked. PancakeSwap urged users not to use their site until the problem had been resolved.
DeFi Cream Finance, initially intended for the Binance Smart Chain but eventually deployed on Ethereum, had also announced an attack an hour earlier.
Binance, portrait of a leader in the cryptoeconomy market
Binance is a young cryptocurrency exchange platform, launched in July 2017 in Hong Kong. Its name "Binance", combines the terms "binary" (binary in French) and "finance". Its founder and current CEO, Zhao Changpeng, became a billionaire in just a few months after the launch of the platform. In fact, he was on the cover of Fordes, the famous American business magazine, in February 2018, just 8 months after the creation of Binance.
Binance offers cryptocurrency storage, purchase, resale and exchange services. Transactions can be carried out in cryptocurrencies, dollars and euros. The platform supports SEPA bank transfers.
Thanks to its attractive pricing, Binance has risen to the top spot among cryptocurrency exchange platforms as of 2018. The company charges just 0.1% commission on transactions, and deposits are free.
The Binance Chain and its annex, the Binance Smart Chain (BSC)
Binance offers its own cryptocurrency, the BNB, which was launched just a few days before the platform was created and currently ranks third on the market with a price of around $250. In April 2019, Binance launched the Binance Chain for its BNB token and to facilitate trading on its platform. However, like all blockchains, the Binance Chain remains limited and can become congested, or even completely blocked, during intensive use of "smart contracts". To accommodate the growing number of users, Binance has launched the Binance Smart Chain.
The Binance Smart Chain makes it possible to launch smart contracts in decentralised finance in order to relieve congestion in the Binance Chain. While the Binance Chain uses DPoS (Delegated Proof of Stake) as its consensus, the Binance Smart Chain uses PoSA (Proof of Stake by Authority). The two chains are independent and can complement each other. The BSC also makes it possible to offer fees 35 times cheaper than the Ethereum blockchain.
Pancakeswap, the Dex of the BSC under attack
Pancakeswap is the first self-proclaimed DEX (decentralised exchange) in the Binance Smart Chain. It uses the Automated Market Maker (AMM), the most popular of the BSC, and offers a range of features to help you earn lots of CAKE (the PancakeSwap token):
Liquidity provider system: possibility of adding liquidity to pools
Staking and farming mechanisms
Extremely popular lottery system: each session lasts 6 hours and lottery tickets cost 10 CAKE. The jackpot corresponds to 50% of the jackpot.
Announcement of the attack on the twitter page of PancakeSwap, the most popular AMM in Binance
At 3.36pm on Monday 15 March, PancakeSwap retweeted Cream Finance (another DeFi), which had announced a few minutes earlier that its DSN had been attacked. PancakeSwap warned in its tweet that they too could have been affected. They informed their followers that checks were underway. Finally, the DEX of the Binance Smart Chain confirmed the attack on his twitter account a few minutes later.
"This is now confirmed. Do NOT go to the Pancakeswap site until we confirm everything is clear. NEVER enter your passphrase or private keys on any website. We are currently working on recovery. Sorry for the inconvenience."
PancakeSwap's DNS address has, in fact, been replaced by that of a mirror site. Users therefore go to this fake site where hackers try to steal their information. In the case of PancakeSwap, it seems that the fake site asks users for their "seed phrases", which give them access to their accounts.
A number of Internet users have taken screenshots to warn of the ploy, which, it has to be said, is rather crude. PancakeSwap retweeted them, urging users not to visit the site and reminding them never to give out their seed phrase or private key. The DEX of the Binance Smart Chain also reassured them at the same time, reminding them that their funds remained protected as long as they did not share this precious information.
Zhao Changpeng, CEO and founder of Binance, was quick to add his own comments on Twitter:
"A number of DeFi projects are subject to a DNS hijacking attack. Pancake, Cream, etc. Please be VERY VERY careful and don't use them until they recover. Please also help raise public awareness."
The Binance Chain Community also retweeted the information, reiterating that users were not at risk as long as they did not re-share their confidential information.
Binance Smart Chain out of danger?
Finally, at around 5pm, PancakeSwap announced that it had regained access to its DSN. However, users are advised to wait for the green light before returning to the site. A platform has also been set up on their Twitter account to monitor developments in the situation.
Here is the link: https://dnschecker.org/#NS/pancakeswap.finance
As the evening progressed, PancakeSwap announced that the servers in the various zones would be restored. For the moment, however, the Twitter accounts of PancakeSwap, Binance and Zhao Changpeng have not yet announced that the situation has been fully restored.
