Key Takeaways
Harmony’s cross-chain bridge Horizon has been exploited for around $100 million in various tokens.
The attacker has sold all stolen funds for Ethereum, but is to launder them through a privacy-protocol like Tornado Cash.
The Harmony team is reportedly working with the Federal Bureau of Investigation and multiple cyber security firms to identify the attacker.
Share this article
The Harmony team has confirmed the Horizon bridge has been exploited for approximately $100 million in various tokens.
Harmony Bridge Hit for $100M
Harmony, an EVM-compatible Proof-of-Stake blockchain, has had its Horizon cross-chain bridge exploited in a major security breach.
1/ The Harmony team has identified a theft occurring this morning on the Horizon bridge amounting to approx. $100MM. We have begun working with national authorities and forensic specialists to identify the culprit and retrieve the stolen funds.
More š§µ
ā Harmony š (@harmonyprotocol) June 23, 2022
The Harmony team confirmed in a Friday morning Twitter post that Horizon, the bridge that connects the Harmony network to BNB Chain and Ethereum, had been exploited for around $100 million in various tokens. āThe Harmony team has identified a theft occurring this morning on the Horizon bridge amounting to approx. $100MM,ā a post from the official Harmony Twitter account said, adding that itās already working with national authorities and forensic experts to identify the attacker and potentially retrieve the stolen funds.
According to on-chain data, the exploit began at around 12:02 UTC on Thursday and lasted for about 15 hours. The attacker executed 16 malicious transactions of various sizes, ranging from 14,190 to 30 ETH before the Harmony team noticed the attack and halted the Horizon bridge to prevent further malicious transactions. After stealing approximately $100 million worth of various tokens, including Frax, Frax Shares, wrapped Ethereum, wrapped Bitcoin, Aave, Sushi, Tether, and Binance USD, the attacker sent them to different wallets, swapped them for Ethereum on the decentralized exchange Uniswap, and then transferred the stolen funds back to the originating wallet.
Uncommon for these types of exploits, the attacker has not yet tried to anonymize the stolen funds through a privacy-protocol like Tornado Cash. In a follow-up Tweet, the Harmony team stated that itās working with the Federal Bureau of Investigation and multiple cyber security firms to track and identify the attacker. The involvement from U.S. authorities means there is a possibility that the Office of Foreign Assets Control will add the attackerās wallet to its sanctioned addresses blacklist, effectively disabling it from laundering the stolen funds through Tornado Cash.
While Harmony hasnāt yet shared specific details about how the exploit occurred, blockchain security experts have speculated that the attacker likely gained access to at least two of the five private keys of the multi-signature wallet controlling the Horizon bridge smart contracts. This attack vector was already highlighted in April by Ape Dev, the pseudonymous founder of the crypto-focused venture firm Chainstride Capital. They said they had investigated the Harmony bridge on Ethereum and found that āif two of the four multisig signers are compromised, weāre going to see another 9 figure hack,ā which appears to be precisely what happened yesterday.
Mudit Gupta, the chief information security officer at Polygon, commented that this was not a āblockchain hackā but a ātraditional hack,ā and speculated that the attacker likely compromised the servers hosting the keys of Horizonās multi-signature wallet. āOnce inside the server, they could access the keys that were kept in plaintext for signing legit transactions,ā he said, adding that the exploit is āeerily similarā to Axie Infinityās $551.8-million Ronin Network exploit from March. In April, the U.S. Treasury Department confirmed that North Koreaās state-sponsored cybercrime group known as Lazarus Group was behind the Ronin Network exploit.
Harmony stated that its trustless Bitcoin bridge was unaffected by the exploit and that it would continue to update the public with new information as it comes in.
Disclosure: At the time of writing, the author of this piece owned ETH and several other cryptocurrencies.
Share this article
The information on or accessed through this website is obtained from independent sources we believe to be accurate and reliable, but Decentral Media, Inc. makes no representation or warranty as to the timeliness, completeness, or accuracy of any information on or accessed through this website. Decentral Media, Inc. is not an investment advisor. We do not give personalized investment advice or other financial advice. The information on this website is subject to change without notice. Some or all of the information on this website may become outdated, or it may be or become incomplete or inaccurate. We may, but are not obligated to, update any outdated, incomplete, or inaccurate information.
You should never make an investment decision on an ICO, IEO, or other investment based on the information on this website, and you should never interpret or otherwise rely on any of the information on this website as investment advice. We strongly recommend that you consult a licensed investment advisor or other qualified financial professional if you are seeking investment advice on an ICO, IEO, or other investment. We do not accept compensation in any form for analyzing or reporting on any ICO, IEO, cryptocurrency, currency, tokenized sales, securities, or commodities.
See full terms and conditions.
