Hackers have stolen $100 million in cryptocurrency from the Blockchain company Harmony. Harmony’s Horizon Bridge allows users to transfer their crypto assets from one blockchain to another.
After the incident, the company immediately halted the bridge to prevent further transactions and notified other exchanges. They also reported the incident to the authorities and the FBI is investigating with the help of several cybersecurity firms.
The company also offers a $1 million bounty in exchange for the return of the funds.
The incident response team of the company stated that it has not found any evidence of breaches of the company smart contract codes or vulnerabilities on the Horizon platform. Harmony also mentioned that the consensus layer of the Harmony blockchain remains secure.
The company released updates stating that their incident response team has discovered evidence that private keys were compromised, leading to the breach of the Horizon bridge. Funds were stolen on the Ethereum side of the bridge. The private keys were encrypted and stored by Harmony, with the keys doubly encrypted via passphrase and a key management service, and no single machine had access to multiple plaintext keys.
The attacker managed to access and decrypt a number of these keys, including those used to sign the unauthorized transactions and take assets in the form of BUSB, USDC, ETH and WBTC. All assets were then swapped to ETH and currently remain on the hacker’s account on the Ethereum network. No steps have currently been taken by the hacker to anonymize ownership of these assets.
The blockchain security firm CertiK also published a detailed analysis of the incident confirming that the threat actors were able to access the owners of Horizon’s multiSig wallets, then stole the funds from Harmony.
According to their report, on June 23, 2022, the bridge between Harmony chain and Ethereum experienced multiple exploits. Their experts have identified twelve attack transactions and three attack addresses. Across these transactions the attacker netted various tokens on the bridge including ETH, USDC, WBTC, USDT, DAI, BUSD, AAG, FXS, SUSHI, AAVE, WETH, and FRAX. The transactions vary in value but range from $49,178 to upwards of $41,200,000. The attacker transferred large amounts of tokens from the bridge on Harmony, which led to a total loss around $97M worth of asset on the Harmony chain.
Comments