Harmony Bridge Hack

REPORTED LOSS $100.0M
Critical Validator private-key compromise and privileged bridge release ethereum bsc

What happened

Attackers drained about $100 million in bridged assets from Harmony's Horizon Bridge on June 23, 2022. Harmony found that the theft occurred on the Ethereum side of the bridge and found no evidence that Harmony consensus or Horizon smart-contract logic itself was compromised. The incident instead centered on the bridge's signing infrastructure.

Technical Root Cause

This was a key-management and authorization-boundary failure, not a demonstrated Solidity logic exploit. Compromise of enough multisig keys gave the attacker legitimate authority to invoke privileged custody-release functions. Bridge security depends on isolated signer infrastructure, a resilient quorum, removal of residual operational access, and monitoring that can stop anomalous high-value releases.

Case & protocol details

Classification Cross-chain Bridge / Compromised Multisig Authority
Implementation language Solidity
Attacker Address 0x0d043128146654c7683fbf30ac98d7b2285ded00

How it happened

Harmony concluded that attackers compromised private keys used to authorize bridge releases. With enough signing authority, they submitted multisignature operations that invoked the bridge manager's privileged unlock paths and released ETH and ERC-20 assets from custody to an attacker-controlled address. The stolen assets were consolidated, swapped to ETH, and later moved through Tornado Cash.

The bridge treated the multisig as its trust boundary, so the release functions operated as designed once the required signers were compromised.

Evidence & learning

Attack pattern

Compare incidents →
Access Control Attacks Cross-Chain Bridge Attacks

Proof of concept

1 available

Sources and on-chain records

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes