Cyber Incident Victim: pNetwork
Date:
Sep 2021
Location:
—
Summary
A decentralized finance protocol suffered a theft of 277 wrapped Bitcoin valued over $12 million due to a codebase vulnerability exploited on Binance Smart Chain. The attacker targeted pBTC on BSC, but other blockchain bridges supported by the platform remained unaffected, with all non-BSC funds secure. The DeFi protocol publicly offered a $1.5 million bounty for the return of stolen assets while initiating security reviews across its bridges. Restoration of Telos and EOS bridges commenced with enhanced protective measures, and the organization committed to publishing a detailed post-mortem analysis. Ongoing efforts focused on gradually reactivating remaining bridges following thorough vulnerability assessments.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On September 19, 2021, decentralized finance protocol pNetwork suffered a security breach resulting in the theft of 277 Bitcoin (valued over $12 million) from its Binance Smart Chain (BSC) bridge. The attacker exploited a vulnerability within pNetwork’s codebase to steal wrapped Bitcoin (pBTC) collateral specifically on the BSC bridge. pNetwork publicly disclosed the incident via Twitter, confirming the attack targeted only the BSC bridge while emphasizing that all other blockchain bridges supported by the platform—including Ethereum, xDAI, EOS, Polygon, Telos, and Ultra—remained unaffected and secure. The theft represented one of several major cross-chain bridge exploits in 2021, occurring shortly after the record-breaking $610 million Poly Network hack in August.
In response, pNetwork immediately initiated an investigation and promised a detailed post-mortem report. The platform offered the attacker a $1.5 million bounty (equivalent to 12.5% of the stolen funds) in exchange for returning the assets, framing the proposal as an effort to support the broader DeFi ecosystem’s growth. Concurrently, pNetwork prioritized security reviews over operational speed, conducting extensive audits of all bridges to identify similar vulnerabilities. By September 20, the platform restored its Telos and EOS bridges with additional security measures temporarily enforced during the initial reactivation phase. pNetwork committed to gradual reactivation of remaining bridges pending further security assessments, with plans to share comprehensive incident analysis and subsequent updates. The financial impact was confined to the BSC bridge’s collateral, with no evidence of broader fund compromise across the network.