Binance successfully blocks $1.2 million DAO attack

The Binance security team promptly discovered the malicious governance proposal to prevent damage to approximately US$1.2 million in tokens in the DAO vault.

The Binance security team intercepted the malicious governance proposal in time before it was implemented, which could endanger approximately US$1.2 million in tokens in the vault of a DAO organization (decentralized autonomous organization). Less than 48 hours before the proposal took effect, the Binance team contacted the project party and coordinated with other centralized exchanges. The DAO community ultimately rejected the proposal and, according to Binance, did not cause any financial losses.

This incident shows that encryption projects need to protect not only against smart contract vulnerabilities, but also against malicious attacks on governance mechanisms.

The risk is not that smart contracts

mention DAO attacks. The first thing people think of is often to exploit vulnerabilities in smart contracts. However, in this incident, the target was not the code itself.

The attacker attempted to exploit a weakness in the governance system along the project chain with the goal of endangering assets in the DAO vault through a malicious proposal.

In this type of attack, the decision-making process becomes critical. Even if a DAO's smart contracts are safe, assets can still be put at risk through other means if the voting system that determines control of the vault is not strong enough.

Binance said its security systems independently detected the proposal. The company also noted that no external security vendor had previously reported the threat. However, Binance did not disclose the name of the project or the technical details of the attack.

How did Binance stop this attack?

When the Binance security team discovered the threat, it was less than 48 hours after the malicious proposal was implemented. This is enough time for the malicious proposal to take effect.

The team first contacted the project directly and reminded the DAO community to vote against the proposal.

Not only that, Binance also coordinated with other centralized exchanges that launched the affected token. These exchanges temporarily shut down the charging function of relevant tokens to make it more difficult to transfer affected funds between platforms in the event of a possible attack.

The DAO ultimately rejected the proposal, preventing attackers from gaining access to the vault through governance mechanisms.

Binance said the attack was stopped before it occurred and did not cause any financial losses.

What does the figure of $1.2 million mean?

Here's an important detail: The US$1.2 million Binance mentioned was not an actual loss.

This number represents the approximate value of the tokens in the DAO vault that may be at risk if the malicious proposal is passed.

Therefore, the current financial result of the event is zero loss. Still, the size of this amount also shows why governance loopholes pose a serious security risk.

Attackers may not need to directly steal private keys or crack smart contracts. A weak enough governance system may be used to abuse decision-making power over the treasury.

Why are DAO governance attacks receiving increasing attention?

Jimmy Su, chief security officer of Binance, said the incident was not limited to platform security. He believes that threats to the encryption industry are increasingly beyond code vulnerabilities.

Attackers are now also targeting users, access nodes and governance systems. Therefore, it may not be enough for security teams to just monitor their own platforms.

In this incident, rapid coordination was established between Binance, the project team and other exchanges, allowing off-chain participants to intervene in on-chain governance threats.

For the DAO, it may not be enough to focus solely on smart contract audits when it comes to ensuring the security of the treasury. Voting rules, proposal review and early detection of attacks are becoming important parts of the security process.

The real risk here is that an attacker does not need to crack the smart contract. Abuse of the voting mechanism used to manage the treasury can also have consequences as serious as technical loopholes.

(The content of this article is based on general market data and does not constitute investment advice. We recommend you conduct your own research.)