{"investigation":{"slug":"harmony-bridge","entity_name":"Harmony Bridge","trust_score":10,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"Harmony's Horizon Bridge is a cross-chain bridge connecting the Harmony (ONE) blockchain to Ethereum and Binance Smart Chain, launched in October 2020. In June 2022, it was exploited for approximately $100 million by the Lazarus Group, a North Korea-affiliated state-sponsored hacking collective, through compromise of a 2-of-5 multisig scheme controlling bridge funds. The FBI formally confirmed Lazarus Group attribution in January 2023; as of 2025, full victim restitution has not been achieved.","sections":[{"content":"Harmony is a layer-1 proof-of-stake blockchain founded by Stephen Tse in 2018 and launched on mainnet in 2019. It was among the first blockchains to implement sharding in a proof-of-stake network. The Horizon Bridge — often referred to simply as the Harmony Bridge — launched in October 2020 as one of the first production cross-chain bridges, enabling 1:1 transfers of ERC-20, BEP-20, and stablecoin assets between Ethereum, Harmony, and Binance Smart Chain via smart contracts deployed on all three chains. At its peak, the bridge held approximately $750 million in total value locked (TVL) and facilitated over $1.5 billion in transaction volume across more than 100,000 cross-chain transactions. The bridge was administered through a 2-of-5 multisignature wallet arrangement, meaning any two of five authorized private keys could approve transactions moving funds from the liquidity pool.","heading":"Background","sources":[{"url":"https://open.harmony.one/horizon-a-gas-efficient-trustless-bridge-for-cross-chain-transactions","name":"","type":"other","credibility":3},{"url":"https://blockworks.com/news/defi-cross-chain-horizon-bridge-hacked-for-100m","name":"","type":"other","credibility":3},{"url":"https://www.benzinga.com/pressreleases/22/10/n29443202/resuming-harmony-cross-chain-bridge-with-layerzero","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On June 24, 2022, attackers executed a series of unauthorized withdrawals from the Harmony Horizon Bridge, extracting approximately $99.6 million across 11 to 14 transactions over a brief window beginning around 5:30 AM PST. The root cause was the compromise of two private keys from the bridge's 2-of-5 multisig wallet — the minimum threshold required to authorize transactions. Stolen assets included ETH, Wrapped Bitcoin (WBTC), USDC, USDT, DAI, BNB, and several other ERC-20 tokens. The primary attacker address identified on-chain was 0x0d043128146654c7683fbf30ac98d7b2285ded00. The MultiSigWallet contract owner called submitTransaction() and then the attacker used transaction ID 21106 to transfer 13,100 ETH to their address. The private keys, while encrypted at rest with a key management service, were alleged to have been accessed via compromise of Harmony's internal servers — likely through SSH key theft or social engineering — allowing the attacker to decrypt and use the signing keys. No single machine was supposed to hold multiple keys in plaintext, but the attacker was nonetheless able to access and decrypt the necessary keys. Between June 27 and July 2, 2022, approximately 85,700 ETH were sent to Tornado Cash across 857 transactions to obfuscate the trail. Elliptic researchers were among the first to attribute the attack to the Lazarus Group (also known as APT38), a DPRK state-sponsored hacking collective, based on distinctive laundering patterns consistent with previous Lazarus operations including the $540 million Ronin Bridge hack of March 2022. The FBI formally confirmed Lazarus Group responsibility on January 23, 2023.","heading":"The Lazarus Multisig Attack","sources":[{"url":"https://www.fbi.gov/news/press-releases/fbi-confirms-lazarus-group-cyber-actors-responsible-for-harmonys-horizon-bridge-currency-theft","name":"","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-harmony-horizon-bridge-hack","name":"","type":"other","credibility":3},{"url":"https://www.merklescience.com/blog/hack-track-analysis-of-harmonys-horizon-bridge-exploit","name":"","type":"other","credibility":3},{"url":"https://techcrunch.com/2022/06/24/harmony-blockchain-crypto-hack/","name":"","type":"other","credibility":3},{"url":"https://techcrunch.com/2023/01/24/north-korea-fbi-harmony-horizon-crypto/","name":"","type":"other","credibility":3},{"url":"https://www.elliptic.co/blog/analysis/over-1-billion-stolen-from-bridges-so-far-in-2022-as-harmony-s-horizon-bridge-becomes-latest-victim-in-100-million-hack","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Blockchain analytics firms including Elliptic and Merkle Science traced the stolen funds through the Ethereum network in detail. The primary attacker address identified was 0x0d043128146654c7683fbf30ac98d7b2285ded00. The MultiSigWallet contract involved was at address 0xf845a7ee8477ad1fb446651e548901a2635a915. Harmony published an address for fund return at 0xd6ddd996b2d5b7db22306654fd548ba2a58693ac. Merkle Science's heuristic analysis identified 148 withdrawal addresses that received mixed stolen funds, with over 84,000 ETH traced through Tornado Cash's mixing contract (T100). Between June 27 and July 2, 2022, the attackers structured 857 deposits into Tornado Cash totaling 85,700 ETH, consistent with Lazarus Group's previously observed programmatic structuring behavior. Following OFAC's sanctioning of Tornado Cash on August 8, 2022, the stolen funds went largely dormant for approximately seven months. On January 13, 2023, North Korean-attributed actors resumed laundering activity, depositing approximately $60 million worth of ETH into Railgun, an Ethereum-based zero-knowledge privacy protocol. Elliptic reported that approximately 99.9% of all Railgun deposits between January 11 and 14, 2023 were proceeds from the Harmony hack — a concentration so high as to render the mixing functionally ineffective for anonymization. The withdrawn Railgun funds were subsequently routed through multiple intermediary hops before approximately 25,500 ETH was directed to customer deposit addresses at Binance, Huobi, and OKX. The FBI published 11 Bitcoin wallet addresses associated with the remaining stolen BTC. The Lazarus Group also moved approximately $96 million of Harmony funds and $468 million from the Ronin hack through Tornado Cash, for a combined total of over $555 million through that single mixer.","heading":"On-Chain Evidence","sources":[{"url":"https://www.elliptic.co/blog/analysis/fbi-confirms-north-korea-s-lazarus-group-as-hackers-behind-100-million-harmony-horizon-bridge-theft","name":"","type":"other","credibility":3},{"url":"https://www.merklescience.com/blog/hack-track-analysis-of-harmonys-horizon-bridge-exploit","name":"","type":"other","credibility":3},{"url":"https://home.treasury.gov/news/press-releases/jy0916","name":"","type":"other","credibility":3},{"url":"https://www.bleepingcomputer.com/news/security/fbi-north-korean-hackers-stole-100-million-in-harmony-crypto-hack/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Harmony offered a $1 million bounty to the attacker for the return of stolen funds, which went unclaimed. In coordination with Binance and Huobi, approximately 124 BTC (valued at roughly $2.5 million at the time) was identified, blocked, and seized from exchange deposit accounts used in the January 2023 laundering attempt — a recovery of less than 3% of the total stolen. In July 2022, Harmony proposed two reimbursement options to victims: Option A, minting 4.97 billion new ONE tokens for an estimated 100% reimbursement; or Option B, minting 2.48 billion ONE tokens for an estimated 50% reimbursement distributed over three years. Community response was overwhelmingly negative, citing inflationary pressure on ONE tokenomics. Following community opposition, Harmony reversed course in September 2022, abandoning all token-minting plans and committing to use its foundation treasury instead for recovery funding. Harmony subsequently established a rolling recovery fund distributing treasury assets monthly to affected users through a smart contract mechanism. As of approximately 2025, the Recovery ONE Foundation reported completing over 33 rounds of distributions totaling more than $4.2 million distributed to victims — representing approximately 4.2% of the original $100 million loss. Harmony also relaunched its cross-chain bridge in late 2022 using LayerZero's validation layer instead of the compromised multisig infrastructure, eliminating the need for Harmony to maintain signing keys.","heading":"Recovery Efforts","sources":[{"url":"https://www.coindesk.com/tech/2022/07/27/harmony-proposes-issuing-one-tokens-to-reimburse-victims-of-100m-hack","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/backlash-as-harmony-proposes-minting-4-97b-tokens-to-reimburse-victims","name":"","type":"other","credibility":3},{"url":"https://decrypt.co/110379/harmony-publishes-revamped-horizon-bridge-recovery-plan","name":"","type":"other","credibility":3},{"url":"https://recoveryonefoundation.medium.com/harmony-recovery-round-10-b6a0bbaa9cd8","name":"","type":"other","credibility":3},{"url":"https://www.benzinga.com/pressreleases/22/10/n29443202/resuming-harmony-cross-chain-bridge-with-layerzero","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"As of 2025, the Harmony protocol continues to operate its blockchain mainnet. The original Horizon Bridge multisig infrastructure was replaced with a LayerZero-backed validation layer following the incident. The Harmony team upgraded the multisig threshold from 2-of-5 to 4-of-5 on the Ethereum side as an interim measure. The Recovery ONE Foundation continues distributing treasury funds to hack victims on a rolling basis, though cumulative distributions represent a small fraction of total losses. The vast majority of stolen funds — approximately $95+ million — remain unrecovered and in the control of Lazarus Group-affiliated wallets or have been laundered beyond practical recovery. The FBI has not announced any arrests or criminal charges in connection with the hack as of the available reporting through 2025. Tornado Cash, which was used to launder the bulk of the stolen funds, was sanctioned by OFAC in August 2022 but sanctions were later challenged in court and delisted following a Fifth Circuit Court of Appeals decision, with Treasury removing Tornado Cash from the SDN list in March 2025. The Harmony ONE token has seen significant price depreciation since the hack. Users who held bridged assets at the time of the exploit remain substantially uncompensated.","heading":"Current Status","sources":[{"url":"https://bridge.harmony.one/faq","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/172364/harmony-announces-update-on-horizon-bridge-attack-recovery-plan","name":"","type":"other","credibility":3},{"url":"https://home.treasury.gov/news/press-releases/jy0916","name":"","type":"other","credibility":3},{"url":"https://www.fbi.gov/news/press-releases/fbi-confirms-lazarus-group-cyber-actors-responsible-for-harmonys-horizon-bridge-currency-theft","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"The Harmony Horizon Bridge hack represents one of the largest single DeFi bridge exploits on record, and stands as a defining case study in multisig key management failure. The core vulnerability — a 2-of-5 multisig threshold with co-located or insufficiently isolated hot wallet keys — required compromising only two keys to authorize arbitrary fund withdrawals. Security researchers at Halborn and Merkle Science have noted that a 2-of-5 threshold provides minimal security when the underlying key storage infrastructure is not adequately hardened. The attack illustrates the systemic risk class of cross-chain bridges acting as high-value, single-point-of-failure honeypots. Lazarus Group's involvement places this incident within a broader pattern of DPRK-affiliated crypto theft estimated at $1.2 billion over the five years preceding 2023, according to South Korea's National Intelligence Service. The laundering methodology — using programmatic Tornado Cash deposits followed by a pivot to Railgun after OFAC sanctions — demonstrates sophisticated operational security adapted to regulatory counter-measures. From a trust and risk perspective: bridge users with assets locked at the time of the exploit have seen less than 5% restitution after over two years. The protocol's decision to reverse its initial reimbursement proposal, offer an alternative treasury plan, and deliver only $4.2 million of approximately $100 million in recovery leaves the Harmony Bridge as a cautionary example of catastrophic infrastructure compromise with inadequate victim recovery.","heading":"Risk Assessment","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-harmony-horizon-bridge-hack","name":"","type":"other","credibility":3},{"url":"https://www.elliptic.co/resources/harmony-horizon-bridge-hack","name":"","type":"other","credibility":3},{"url":"https://techcrunch.com/2023/01/24/north-korea-fbi-harmony-horizon-crypto/","name":"","type":"other","credibility":3},{"url":"https://securityaffairs.com/141266/apt/harmony-horizon-bridge-lazarus-apt.html","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2020-10","event":"Harmony Horizon Bridge launched, enabling cross-chain transfers between Harmony, Ethereum, and Binance Smart Chain","source":"","date_original":"2020-10-01"},{"date":"2022-06-23","event":"Harmony Protocol team notified of a malicious attack on the Horizon Ethereum Bridge","source":""},{"date":"2022-06-24","event":"Approximately $99.6 million stolen from the Horizon Bridge across 11-14 transactions via compromised 2-of-5 multisig keys; attacker address 0x0d043128146654c7683fbf30ac98d7b2285ded00 identified","source":""},{"date":"2022-06-24","event":"Harmony offered a $1 million bounty for return of stolen funds; no response received","source":""},{"date":"2022-06-27","event":"Attackers begin 857-transaction series of Tornado Cash deposits totaling 85,700 ETH, continuing through July 2, 2022","source":""},{"date":"2022-07-27","event":"Harmony proposes two reimbursement options: minting 4.97 billion or 2.48 billion ONE tokens to compensate hack victims","source":""},{"date":"2022-08-08","event":"OFAC sanctions Tornado Cash, citing its use by the Lazarus Group to launder funds from Harmony and other hacks","source":""},{"date":"2022-09-23","event":"Harmony reverses token-minting reimbursement plan following community backlash; commits to treasury-funded recovery with 0% new minting","source":""},{"date":"2022-10","event":"Harmony relaunches cross-chain bridge using LayerZero validation layer, replacing the compromised multisig infrastructure","source":"","date_original":"2022-10-01"},{"date":"2023-01-13","event":"North Korean-attributed actors resume laundering, depositing approximately $60 million in ETH into Railgun privacy protocol; 99.9% of Railgun deposits during this window traced to Harmony hack proceeds","source":""},{"date":"2023-01-14","event":"Binance and Huobi identify, block, and freeze approximately 124 BTC (~$2.5 million) deposited from the laundering addresses","source":""},{"date":"2023-01-23","event":"FBI formally confirms Lazarus Group (APT38) was responsible for the June 2022 Harmony Horizon Bridge theft; publishes 11 associated Bitcoin wallet addresses","source":""},{"date":"2025-03","event":"U.S. Treasury removes Tornado Cash from OFAC SDN list following Fifth Circuit Court of Appeals decision overturning sanctions","source":"","date_original":"2025-03-01"}],"sources_used":[{"url":"https://open.harmony.one/horizon-a-gas-efficient-trustless-bridge-for-cross-chain-transactions","name":"","type":"other","archive_url":"http://web.archive.org/web/20260708085840/https://open.harmony.one/horizon-a-gas-efficient-trustless-bridge-for-cross-chain-transactions","credibility":3,"archive_timestamp":"2026-07-08T08:58:40+00:00"},{"url":"https://blockworks.com/news/defi-cross-chain-horizon-bridge-hacked-for-100m","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.benzinga.com/pressreleases/22/10/n29443202/resuming-harmony-cross-chain-bridge-with-layerzero","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.fbi.gov/news/press-releases/fbi-confirms-lazarus-group-cyber-actors-responsible-for-harmonys-horizon-bridge-currency-theft","name":"","type":"other","archive_url":"http://web.archive.org/web/20260822132114/https://www.fbi.gov/news/press-releases/fbi-confirms-lazarus-group-cyber-actors-responsible-for-harmonys-horizon-bridge-currency-theft","credibility":3,"archive_timestamp":"2026-08-22T13:21:14+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-harmony-horizon-bridge-hack","name":"","type":"other","archive_url":"http://web.archive.org/web/20260605232620/https://www.halborn.com/blog/post/explained-the-harmony-horizon-bridge-hack","credibility":3,"archive_timestamp":"2026-06-05T23:26:20+00:00"},{"url":"https://www.merklescience.com/blog/hack-track-analysis-of-harmonys-horizon-bridge-exploit","name":"","type":"other","archive_url":"http://web.archive.org/web/20260511054126/https://www.merklescience.com/blog/hack-track-analysis-of-harmonys-horizon-bridge-exploit","credibility":3,"archive_timestamp":"2026-05-11T05:41:26+00:00"},{"url":"https://techcrunch.com/2022/06/24/harmony-blockchain-crypto-hack/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260720175136/https://techcrunch.com/2022/06/24/harmony-blockchain-crypto-hack/","credibility":3,"archive_timestamp":"2026-07-20T17:51:36+00:00"},{"url":"https://techcrunch.com/2023/01/24/north-korea-fbi-harmony-horizon-crypto/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260309022918/https://techcrunch.com/2023/01/24/north-korea-fbi-harmony-horizon-crypto/","credibility":3,"archive_timestamp":"2026-03-09T02:29:18+00:00"},{"url":"https://www.elliptic.co/blog/analysis/over-1-billion-stolen-from-bridges-so-far-in-2022-as-harmony-s-horizon-bridge-becomes-latest-victim-in-100-million-hack","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829151517/https://www.elliptic.co/insights/over-1-billion-stolen-from-bridges-so-far-in-2022-as-harmony-s-horizon-bridge-becomes-latest-victim-in-100-million-hack/","credibility":3,"archive_timestamp":"2026-08-29T15:15:17+00:00"},{"url":"https://www.elliptic.co/blog/analysis/fbi-confirms-north-korea-s-lazarus-group-as-hackers-behind-100-million-harmony-horizon-bridge-theft","name":"","type":"other","archive_url":"http://web.archive.org/web/20260519161602/https://www.elliptic.co/blog/analysis/fbi-confirms-north-korea-s-lazarus-group-as-hackers-behind-100-million-harmony-horizon-bridge-theft","credibility":3,"archive_timestamp":"2026-05-19T16:16:02+00:00"},{"url":"https://home.treasury.gov/news/press-releases/jy0916","name":"","type":"other","archive_url":"http://web.archive.org/web/20260822123118/https://home.treasury.gov/news/press-releases/jy0916","credibility":3,"archive_timestamp":"2026-08-22T12:31:18+00:00"},{"url":"https://www.bleepingcomputer.com/news/security/fbi-north-korean-hackers-stole-100-million-in-harmony-crypto-hack/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260321172758/https://www.bleepingcomputer.com/news/security/fbi-north-korean-hackers-stole-100-million-in-harmony-crypto-hack/","credibility":3,"archive_timestamp":"2026-03-21T17:27:58+00:00"},{"url":"https://www.coindesk.com/tech/2022/07/27/harmony-proposes-issuing-one-tokens-to-reimburse-victims-of-100m-hack","name":"","type":"other","archive_url":"http://web.archive.org/web/20251119053620/https://www.coindesk.com/tech/2022/07/27/harmony-proposes-issuing-one-tokens-to-reimburse-victims-of-100m-hack","credibility":3,"archive_timestamp":"2025-11-19T05:36:20+00:00"},{"url":"https://cointelegraph.com/news/backlash-as-harmony-proposes-minting-4-97b-tokens-to-reimburse-victims","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829130006/https://cointelegraph.com/news/backlash-as-harmony-proposes-minting-4-97b-tokens-to-reimburse-victims","credibility":3,"archive_timestamp":"2026-08-29T13:00:06+00:00"},{"url":"https://decrypt.co/110379/harmony-publishes-revamped-horizon-bridge-recovery-plan","name":"","type":"other","archive_url":"http://web.archive.org/web/20260517115444/https://decrypt.co/110379/harmony-publishes-revamped-horizon-bridge-recovery-plan","credibility":3,"archive_timestamp":"2026-05-17T11:54:44+00:00"},{"url":"https://recoveryonefoundation.medium.com/harmony-recovery-round-10-b6a0bbaa9cd8","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://bridge.harmony.one/faq","name":"","type":"other","archive_url":"http://web.archive.org/web/20260121165742/https://bridge.harmony.one/faq","credibility":3,"archive_timestamp":"2026-01-21T16:57:42+00:00"},{"url":"https://www.theblock.co/post/172364/harmony-announces-update-on-horizon-bridge-attack-recovery-plan","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.elliptic.co/resources/harmony-horizon-bridge-hack","name":"","type":"other","archive_url":"http://web.archive.org/web/20260130000727/https://www.elliptic.co/resources/harmony-horizon-bridge-hack","credibility":3,"archive_timestamp":"2026-01-30T00:07:27+00:00"},{"url":"https://securityaffairs.com/141266/apt/harmony-horizon-bridge-lazarus-apt.html","name":"","type":"other","archive_url":"http://web.archive.org/web/20260610214535/https://securityaffairs.com/141266/apt/harmony-horizon-bridge-lazarus-apt.html","credibility":3,"archive_timestamp":"2026-06-10T21:45:35+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:49.110023+00:00","updated_at":"2026-08-30T05:14:13.113871+00:00"}}