The Harmony Bridge Hack Explained: $100M
Quick answer. In June 2022, an attacker used two compromised keys to drain about $100M from Harmony's Horizon bridge, which needed only two signatures. The defenses: a higher threshold, keys on separate systems, and alerts on intrusions and bridge outflows.
Video transcript
Harmony's Horizon bridge lost about one hundred million dollars in June 2022. Harmony found no sign its smart contracts were hacked. Two compromised keys were enough.
On June 23, an attacker began draining fourteen bridged assets. DefiLlama, Rekt and the FBI all put the loss at about one hundred million dollars.
Rekt reported the bridge ran on a two of five multisig. Harmony counts at least two of four keys compromised. Either way, two signatures could move the funds.
Harmony believes a phishing scheme put malware on a developer's laptop. That exposed how the bridge ran. Backdoor access to servers followed, and at least two validator keys were compromised.
The signs came early. Server logs hint the attacker began reviewing the bridge on June 2, three weeks before the theft. In January 2023, the FBI named Lazarus Group and APT38.
The lessons are about custody. Check the threshold first. Ronin needed five keys and still fell. Treat key servers as the real risk, guard developer laptops, and give early warning signs an owner.
Guardian's OpSec Audit maps to each gap: custody and key ceremony, access and change control, people and response. You get a threat model and a ranked list of changes.
Read the full article for the timeline and Harmony's fixes. Or talk to Guardian at guardian.security about what your quorum really requires.
Harmony's Horizon bridge held assets bridged from Ethereum and BNB Chain.
Three months after Ronin, it lost about $100 million the same way: through keys, not contract code.
Two details make it a key custody case: a low signing threshold, and keys an intruder could reach.
What Happened
At 11:06 UTC on June 23, 2022, an attacker began moving the bridge's assets to a new account, Harmony says.
Fourteen bridged assets went, including USDC, ETH and USDT on Ethereum and BNB on BNB Chain.
The perpetrator "compromised at least two out of four private keys of the bridge validators," Harmony says. The funds went through new wallets and into Tornado Cash.
Rekt reported that the theft was announced over 14 hours after the first funds moved.
Harmony found "no evidence to date that the bridge smart contracts, or the blockchain protocol, were compromised."
How the Attack Worked
Two signatures were enough
The bridge "was secured by a 2 of 5 multisig," Rekt reported. Two signatures could move funds.
Harmony's own summary counts the compromised keys as at least two out of four. Either way, two keys were enough.
Keys decrypted on privileged servers
Harmony says decrypting the bridge keys "would have required several operations from within a secure set of servers," run with privileged access.
Rekt, writing the next day, said the vector "remains unknown." Harmony gave its own account on August 5, in three steps:
- A phishing scheme tricked at least one developer into installing malware on a laptop.
- That let the attacker read chats on running the bridge, or reach private bridge code.
- The attacker gained backdoor access to one or more servers.
"The perpetrator(s) were successfully able to do all three," Harmony wrote. It believes this was "a coordinated attack targeting our internal infrastructure."
Timeline and Loss
| Date | Event | Source |
|---|---|---|
| Jun 2, 2022 | Server logs hint the attacker began reviewing the bridge | Harmony |
| Jun 17, 2022 | Latest known attempt to induce a trojan-horse install | Harmony |
| Jun 18, 2022 | Harmony finds a flaw exposing private server addresses | Harmony |
| Jun 23, 2022, 11:06 UTC | Bridge assets start moving to the attacker | Harmony; Rekt |
| Over 14 hours later | The theft is announced | Rekt |
| Aug 5, 2022 | Harmony publishes its incident summary | Harmony |
| Jan 13, 2023 | $60M in ETH laundered through Railgun | FBI, via TechCrunch |
| Jan 23, 2023 | FBI names Lazarus Group and APT38 | FBI, via The Block |
The loss figures agree:
- DefiLlama: $100 million.
- Rekt: $100 million, including 13.1k ETH and 5k BNB.
- FBI: $100 million, per The Block.
Harmony says about 64,000 wallets were affected, about 50,000 of them bridged wallet owners.
It offered a $1 million bounty for the funds, later raised to $10 million. By August it had "not received a legitimate response."
Attribution
The FBI said Lazarus Group and APT38 "committed the theft of $100 million of virtual currency from Harmony's Horizon bridge," The Block reported.
Part of the laundered funds was frozen with help from some virtual asset service providers, the FBI said, per TechCrunch.
Our Lazarus Group playbook covers the group's methods.
What It Shows
Thresholds are the first number to check
At Harmony, two keys were enough. Ronin needed five and still fell, because four sat with one company.
Encryption moves the risk to the servers
Harmony's bridge keys could only be decrypted on privileged servers. Harmony believes the attacker gained backdoor access to one or more servers.
Where keys are generated and held deserves its own procedure. Our guide to what a key ceremony is covers it.
Developer laptops sit on the path to keys
Harmony's account starts with malware on at least one developer's laptop. From there, the attacker learned how the bridge ran.
Early signs need an owner
Harmony later found server logs hinting that the attacker began reviewing the bridge as early as June 2, three weeks before the theft.
A trojan attempt or newly exposed internal addresses is a reason to review who can reach the keys.
After the hack, Harmony set up a Security Operations team. Its summary lists the practices it was rolling out:
- Single sign-on with multi-factor authentication.
- VPN access.
- Clear separation of sensitive and insensitive data.
- Full traceability of access at every entry point.
It also paused its separate Bitcoin bridge, gave it an expanded key set, and moved its multisig signers to new keys.
Harmony ranks ninth in our list of the biggest bridge hacks, one of five in the top 12 that came through keys and signers.
How Guardian's OpSec Audit Maps This
Harmony's loss ran through a threshold, key storage and a developer's laptop. Those are the subject of Guardian's OpSec Audit.
Its first area is the threat model: the contracts that hold your funds, the roles that can move them, and the keys, signers and multisigs behind each one.
Harmony's gaps line up with the audit's other areas:
| In Harmony's record | Audit area | What the area covers |
|---|---|---|
| Two signatures could release bridge funds | Custody and key ceremony | Where the keys live, and what a quorum requires in practice |
| A laptop install that led to backdoor server access | Access and change control | Access across every system, secrets handling, separation between environments |
| Signs of intrusion weeks before the theft | People and response | Single points of failure, and whether incident runbooks hold up |
You receive the threat model of your funds and a ranked list of changes to make, each tied to the path it closes.
Paired with Managed Security, that threat model stays current, with every multisig transaction and deployment reviewed as it lands.
Frequently Asked Questions
How much was stolen in the Harmony bridge hack?
About $100 million, per Rekt, DefiLlama and the FBI. Harmony says 14 bridged assets were taken, including USDC, ETH and USDT on Ethereum and BNB on BNB Chain, and about 64,000 wallets were affected.
Who hacked the Harmony Horizon bridge?
In January 2023, the FBI said Lazarus Group and APT38, cyber actors associated with North Korea, committed the theft, The Block reported. It also said $60 million in ETH was laundered through Railgun, and part was frozen, per TechCrunch.
How were Harmony's bridge keys compromised?
Harmony believes a phishing scheme put malware on at least one developer's laptop. From there, the attacker learned how the bridge ran, gained backdoor access to servers, and compromised at least two validator keys.
Were the Horizon bridge smart contracts hacked?
Harmony says no. It found "no evidence to date that the bridge smart contracts, or the blockchain protocol, were compromised." The attacker signed with compromised validator keys instead.
Sources
- Harmony: Summary of the Harmony Horizon Bridge Incident (August 5, 2022)
- Rekt: Harmony Bridge, Rekt (June 24, 2022)
- DefiLlama: Hacks dataset API (read November 6, 2026)
- The Block: FBI confirms Lazarus Group and APT38 were responsible for $100 million bridge hack (January 23, 2023)
- TechCrunch: FBI accuses North Korean government hackers of stealing $100M in Harmony bridge theft (January 24, 2023)
- Guardian: Biggest Bridge Hacks Ranked, With Root Causes (November 2026)
- Guardian: OpSec Audit
- Guardian: Managed Security
Check what your quorum really requires
Guardian maps every path to your funds and reviews how your team actually holds, approves and changes them.