Orbit Bridge
Last changed 2026-11-01 · Fact-check review — Fact-check review (verdict: revise): the reviewer checked the page's claims against its sources; the trust score did not change. Version history →
Why this score
| Every page starts at | 65 |
| Incidents it suffered (e.g. hacks) | -20 |
| Problems around it, caused by others | -1.8 |
| Long-running | +10 |
| Sum | 53 |
- The penalty for incidents it suffered is capped at 20 points.
- 1 section set aside: the claims did not hold up in a fact-check, pending correction.
Score: 53/100 (kept between 0 and 100)
How scoring works →Page reliability: Fact-checked 2026-11-01 · 4 of 6 claims confirmed · 2 need better sources
anchored·2XtCQy…v12xSummary
Orbit Bridge is the cross-chain bridging protocol of Orbit Chain, developed by South Korean blockchain company Ozys. On December 31, 2023, an attacker who controlled seven of ten multisig signers drained approximately $81.5 million in ETH, WBTC, USDT, USDC and DAI from its Ethereum vault; analysts have alleged links to North Korea's Lazarus Group, and Ozys alleges its former chief information security officer weakened the company firewall before the attack, though neither claim has been confirmed by authorities or a court. Most of the stolen funds have since been laundered through Tornado Cash, and no material recovery had been reported as of mid-2025.
Connected Entities
11 entities · 60 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- Belt Finance→mentioned with→Ethereum(65%)
- Alameda Research→mentioned with→Alameda(70%)
- Orbit Bridge→mentioned with→CoinEx(65%)
- Orbit Bridge→mentioned with→Ethereum(80%)
- Orbit Bridge→mentioned with→Avalanche(60%)
- CoinEx→mentioned with→Ethereum(70%)
- CoinEx→mentioned with→Bitcoin(80%)
- Alameda→mentioned with→Alameda Research(80%)
- Belt Finance→mentioned with→Orbit Bridge(80%)
- + 17 more
Timeline(15 events)
2018
Orbit Chain launched by Ozys as a cross-chain bridging protocol supporting multiple public blockchains.
November 2023
Ozys' chief information security officer submits a voluntary resignation request (November 20, per Ozys).
The BlockNovember 2023
Alleged: the outgoing CISO makes unauthorized changes to Ozys' internal firewall policies (November 22, per Ozys; unproven in court).
The BlockDecember 2023
The former CISO formally departs Ozys without disclosing the firewall changes or providing handover documentation (December 6, per Ozys).
The BlockDecember 2023
Exploit of the Orbit Bridge Ethereum vault on December 31: the attacker, having pre-funded an intermediary wallet with 10 ETH from Tornado Cash, drains 9,500 ETH, 231 WBTC, 30M USDT, 10M USDC and 10M DAI (approximately $81.5M). Reports differ: five withdrawals from about 21:08 to 21:25 UTC, or six transactions from about 20:52 UTC (05:52 to 06:25 KST, January 1).
Rekt NewsDecember 2023
Development team notified at 07:05 KST; Ethereum vault and bridge contract shut down at 07:21 KST (approximately 22:21 UTC, December 31).
Orbit Chain (Medium): Official statement regarding Orbit Bridge exploit2024
Orbit Chain publicly confirms the exploit (January 1). Seoul Metropolitan Police notified at 10:00 KST and KISA at 10:35 KST per Ozys; another account says the NIS was notified by 10:35 KST. Security firm Theori engaged.
The RecordJanuary 2024
ChainLight engaged for forensic analysis; Orbit Chain attempts on-chain communication with the attacker and asks exchanges to freeze stolen assets.
January 2024
Match Systems publishes a report alleging the attacker's tools and patterns are consistent with Lazarus Group and linking the attacker to the Atomic Wallet, CoinsPaid and CoinEx hacks.
ICOholderJanuary 2024
Investigators discover the former CISO's November 22 firewall changes; Ozys notifies the NIS, which opens a formal investigation together with the National Police Agency and KISA. NIS says no direct North Korea link is confirmed but the possibility is being examined. Negotiations with the attacker reported to have failed.
CryptonewsJanuary 2024
Orbit Chain announces an $8 million public bounty for information leading to attacker identification or fund recovery.
SocketJanuary 2024
Ozys publicly alleges its former CISO weakened the company firewall before the hack and files a civil lawsuit and police petition against the unnamed former employee.
DailyCoinFebruary 2024
Ozys publishes a draft Asset Recovery and Ecosystem Normalization Plan targeting $82M in recovery over two years.
Orbit Chain (Medium): Asset Recovery and Ecosystem Normalization Plan draftJune 2024
After about five months of dormancy, the attacker moves 12,932 ETH (approximately $47.7M to $48M) through Tornado Cash in seven transactions.
The Block2025
Attacker transfers a further 4,320 ETH (approximately $18.81M) through Tornado Cash, bringing the total laundered to 17,242 ETH (approximately $66.35M); about 9,511 ETH and 20M DAI reportedly remain in attacker wallets.
Blockchain.NewsDecision Log
- slot 464256482 · hash ubXXY7zVgefhATupL4DCEyU1w64sS32PN11kFuWqL4d
- slot 464256476 · hash UHMQCHznwixVtjmEeUww3iyvVJjMras4D224JMYQuLw
- slot 464256186 · hash HQxrYa4jefPR1XiKCKEZx9oj71VMvEYGX4MoXE73kYfm
- slot 455359191 · hash 7zDSeDC1TFLKs9CbX6zijRFxods6ajxym9CpA7j5wmPD
- slot 421014726 · hash 9Rr5BR22K2tkSie5fpq2gFrHyHRFEhKMVUqnvuuEohWr
This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 27 of 36 cited source URLs have an Internet Archive snapshot.
model: claude-code-merge-writer
generated: 5/4/2026, 2:54:36 AM
last updated: 11/1/2026, 10:15:14 PM
5 viewsavoid.net — verified advice for a post-truth world