Horizon by Harmony Hack
What happened
Harmony’s Horizon bridge lost about $100 million on 23 June 2022. Harmony reported that attackers obtained enough validator private keys to authorize withdrawals from the Ethereum side of the bridge.
The incident was a validator-key compromise rather than a demonstrated bridge-contract bug. Harmony said encrypted keys were accessed and decrypted; the FBI later attributed the theft to Lazarus Group.
Case & protocol details
How it happened
- Attackers first obtained and decrypted enough validator private keys to control bridge signing.
- They then authorized transfers of bridged assets from the Ethereum side to an external account.
- Harmony halted the bridge and moved to stronger multisig controls; the FBI later attributed the theft to Lazarus Group.
Funds Recovery
Recovered
$1.4M
Net Loss
$98,600,000
Post-Incident Timeline
-
2023-02-14
Crypto exchanges Binance and Huobi today froze accounts containing approximately $1.4 million in crypto assets originating from the June 2022 hack of Harmony’s Horizon Bridge.
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Post-mortem rekt.news
- report Report certik.com
- report Report cnbc.com
- report Report techcrunch.com
- report Harmony’s Horizon Bridge Hack medium.com
- analysis Web Archive web.archive.org
- analysis FBI Confirms Lazarus Group Responsible for Horizon Theft fbi.gov
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
