Orbit Chain Hack

On 31 December 2023 (UTC) an attacker drained about $81.5 million from Orbit Bridge's Ethereum vault: 30 million USDT, 10 million USDC, 10 million DAI, about 231 WBTC (about $10 million) and 9,500 ETH (about $21.5 million), more than half of the bridge's TVL. The withdrawals were authorized through the vault's multisig. On-chain analysts reported that the attacker controlled seven of the ten signers, though Orbit did not publish the exact vector.

The attacker's address was funded through Tornado Cash, and the loot was swapped into ETH and DAI and split across eight wallets. Orbit deactivated the bridge about an hour after the last withdrawal. On 25 January 2024 developer Ozys said its former chief information security officer had weakened its internal firewall on 22 November 2023, two days after asking to resign, and left on 6 December without disclosing the change.

Ozys filed a damages lawsuit and asked police to investigate his possible involvement. It also alerted the National Intelligence Service to possible involvement by North Korea's Lazarus Group, whose methods analysts said the attack resembled. Neither link has been confirmed in an opened source.