Horizon by Harmony Hack

TOTAL LOST $100M
Critical #77 All-Time Access Control

Summarize with AI

ChatGPT Perplexity Claude Grok
Affected Chain 2022 Incident surface
Recovered $1.4M 1.4% returned
All-Time Rank #77 By amount stolen
Protocol Type Exploit/Access control Target category

Incident Overview

Quick Summary

Harmony's Horizon Bridge was exploited by an attacker resulting in losses of roughly $100M. The bridge was secured by multisig wallet which needed 2 out of 5 wallets to confirm transaction. The hacker gained control over 2 wallets which enabled the attacker to drain the funds of the bridge and transfer said funds to his wallet.

Details of the Exploit

For yet unspecified reasons the attacker gained access over 2 of the 5 multisig wallets.

The attacker was able to enter and confirm transactions by himself. The exploit resulted in the loss of: ETH, USDC, WBTC, USDT, DAI, BUSD, AAG, FXS, SUSHI, AAVE, WETH, and FRAX. The ONE token was not affected by this attack.

For more context, bridges in DeFi are used to enable interoperability between blockchains. Through bridges a user of DeFi may pursue opportunities in an ecosystem that is not native to the coins or tokens a user is holding. For example through Harmony's Horizon Bridge a user holding $ETH on the Ethereum network could bridge $ETH over to the Harmony blockchain receiving newly minted wrapped $1ETH on a 1:1 ratio.

Since the funds on the bridge were seized by the attacker, the receipt was no longer backed by the collateral on a 1:1 ratio. The depreciation of the wrapped assets were felt by users in the form of massive slippages on dexes and other bridges as users tried to flee the Harmony Ecosystem.

Below a breakdown of the specific function used by the attacker.

1) The multisig owner called the submitTransaction(), then to confirm owner calls confirmTransaction() from the MultiSigWallet with the input transactionId 21106.

2) The executeTransaction() function has made an external call with input that will call the unlockEth() function in the Ethmanager contract. The input specifies the amount, recipient, and receiptId to be passed to the unlockEth() function.

3) The following steps were repeated with different ids.

Block Data Reference

Attacker transactions:

640K BUSD: https://bscscan.com/tx/0x4ed79413…500668

Link to attacker draining bridge for ERC20 tokens: https://etherscan.io/address/0x0d043128…5ded00#tokentxns

Multisig wallet addresses that were compromised:

1) https://etherscan.io/address/0xf845a7ee…35a915

2) https://etherscan.io/address/0x812d8622…6f8f25

These addresses confirmed the transaction with id 21108. It can be checked by this multisig wallet (https://etherscan.io/address/0x715CdDa5…496De6#readContract) in the getConfirmations() function.

Attacker addresses:

1) https://etherscan.io/address/0x0d043128…5ded00

2) https://etherscan.io/address/0x58f4bacc…c48fa9

3) https://etherscan.io/address/0x9e91ae67…d08715

4) https://etherscan.io/address/0x1ec6f83b…f16430

5) https://etherscan.io/address/0x432a9cb4…6847ae

6) https://etherscan.io/address/0x4507ac1b…505970

7) https://etherscan.io/address/0x8a085888…69c3f4

Victim addresses:

Harmony ETH Bridge: https://etherscan.io/address/0xf9fb1c50…f3a8a6

Harmony ERC20 Bridge: https://etherscan.io/address/0x2dCCDB49…620857

Harmony BUSD Bridge: https://etherscan.io/address/0xfd53b1b4…a2c628

Funds from the Harmony hack are being laundered via Tornado Cash mixing services. In total 42,000 ETH ~$44,7m have been laundered as the time of writing.

Technical Root Cause

Crypto exchanges Binance and Huobi today froze accounts containing approximately $1.4 million in crypto assets originating from the June 2022 hack of Harmony’s Horizon Bridge.

Learn to detect root-cause vulnerabilities like this in the Smart Contract Hacking course or start your free trial.
This is classified as a Access Control Attacks . Compare similar hacks →

Incident Report

Protocol / Project Horizon by Harmony
Date of Incident
Attack Technique Access Control
Classification Bridge
Primary Source View Post-Mortem #1 View Post-Mortem #2 View Post-Mortem #3 View Post-Mortem #4

Protocol Information

Protocol Type Exploit/Access control
Affected Token ONE
Official Website www.harmony.one/
Protocol Twitter/X @harmonyprotocol
Team Public / Doxxed
Source Code Verified On-Chain

What the Attacker Needed to Succeed

Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.

Technical Knowledge Operational-security tradecraft (phishing, malware, leaked seed phrases, or insider access) to obtain treasury signing authority
Capital Required Minimal capital - only enough to cover gas while draining the compromised accounts
On-Chain Access Valid signing authority over the compromised wallets / multisig signers, allowing direct transfer of funds or stake authorization
Target Reconnaissance Identification of Horizon by Harmony's high-value treasury accounts and the authority / multisig structure controlling them
Execution Speed Speed to drain the compromised accounts before the team detects the breach and revokes signing authority or freezes the assets
Obfuscation Plan A strategy to launder and move stolen funds - typically through mixers, cross-chain bridges, or decentralized DEX swaps to resist tracing

What Auditors Should Check

Could this have been caught in audit? Likely — with a thorough Access Control audit checklist and test coverage

If you're auditing a protocol with similar architecture to Horizon by Harmony, these are the critical security checks that could have prevented this incident (June 2022).

  • Verify all logic paths related to Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
  • Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs

Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.

Free Trial

Funds Recovery

1.4%

Recovered

$1.4M

Net Loss

98600000

Post-Incident Timeline

  • 2023-02-14

    Crypto exchanges Binance and Huobi today froze accounts containing approximately $1.4 million in crypto assets originating from the June 2022 hack of Harmony’s Horizon Bridge.

Related Attack Classes

The technique used in this hack maps to these vulnerability classes in our security curriculum:

See all Access Control Attacks examples →

Access Control Attacks

Sources & References

Browse all hacks

These hacks used the same attack technique. Understanding the pattern helps prevent future exploits.

Token of Power $472K
Access Control
Humanity Protocol $31.0M
Access Control
Tessera DAO $2.4M
Access Control
Gravity Bridge $5.4M
Access Control
Stake DAO $91K
Access Control
Third-party SquidRouterModule $3.2M
Access Control

Learn to Prevent the Next Horizon by Harmony

The Horizon by Harmony hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.

Start Free Trial Browse Attack Library
Recreate exploit patterns safely Free Trial