The Orbit Bridge Hack Explained: $81.5M

Video transcript

Orbit Bridge's Ethereum vault was drained on December 31, 2023. Three explanations exist, and none is confirmed.

About 81.5 million dollars left, per Rekt and The Block, which Rekt says was more than half the bridge's total value locked.

Orbit says the unidentified access was confirmed at 20:52 UTC. Rekt logs withdrawals from 21:08, and the bridge was deactivated at 22:21.

Rekt says compromised signer keys were the first assumption, and others suggested a replay bug. Orbit has denied both. Ozys, the developer, alleges a weakened firewall.

Ozys alleges its former CISO changed firewall settings on November 22, after asking to resign. The CISO left on December 6, and Ozys found the changes on January 10. These are allegations.

The cause is open, so this is no verdict on Orbit. But whatever the vector, the vault released the funds, and in a multisig, signers hold that power.

Map each signer key and test what a partly compromised set can force. Alert on firewall and access changes, review staff exits, cap outflows per asset, and rehearse a shutdown.

Guardian's Offchain Automation Pentest tests threshold signers with a partly compromised set. The Infrastructure Pentest covers the hosts and networks around them.

Read the full article for sources and open questions. Then talk to Guardian at guardian.security to find out what part of your signer set can force.

Ozys, a South Korean company, developed Orbit Bridge, a cross-chain protocol. The drain took more than half the bridge's total value locked, Rekt reported.

What is public comes from a few statements and a handful of reports. This post sets out what each says, and what each leaves open.

What Happened

Orbit's acknowledgement said an "unidentified access to Orbit Bridge" was confirmed at 20:52:47 UTC on December 31, Rekt reported.

In Korea it was already 05:52 on January 1, the date some reports use.

Rekt says the attack began just after 21:00 UTC, and the alarm was raised a few minutes later. The bridge was deactivated at 22:21 UTC.

What left the vault, per Rekt and The Block:

• 30 million USDT, 10 million USDC and 10 million DAI.
• 231 wBTC, about $10 million.
• 9,500 ETH, about $21.5 million.

Rekt says the stablecoins and wBTC were swapped for ETH. It also reports that the attacker's address was funded through Tornado Cash, via an intermediary address.

On January 2, 2024, Orbit said the funds "remain unmoved." It had asked exchanges to freeze them and was working with security firms and law enforcement, The Block reported.

In June 2024, citing Arkham Intelligence, The Block reported that the exploiter had begun moving about $48 million through Tornado Cash.

How the Attack Worked

The exact vector has not been published. Rekt wrote that the team was "yet to disclose the exact nature of the attack vector."

In June 2024, The Block wrote that Orbit still had not given a definitive explanation.

Three accounts are on the record. None is confirmed.

Compromised signer keys

Rekt said the hack was "initially assumed to be due to compromised keys of signer-addresses on the Orbit's ETH Vault multisig."

In a vault like this, a withdrawal executes once enough signers approve it. Whoever holds enough of those keys can sign withdrawals the vault will honor.

Orbit has since said the incident did not result from "the theft of a validator key," The Block reported in June 2024.

A replay bug

Rekt noted that others had suggested a transaction replay bug, similar to a "known issue" in Theori's audit.

Orbit has said the incident did not result from "a vulnerability in the Orbit Bridge smart contract," per the same Block report.

The firewall allegation

On January 25, 2024, Ozys alleged in a blog post that its former CISO had weakened the company firewall before the breach, The Block reported.

Ozys's account, as reported by The Block and crypto.news:

• November 22, 2023: two days after asking to resign, the CISO changed internal firewall settings.
• December 6: the CISO left without telling the company about the changes.
• January 10, 2024: Ozys found the changes.

Ozys did not name the person. It filed a damages lawsuit and asked police to investigate the former CISO's possible involvement.

These are allegations. The statement, as reported, does not explain how a firewall change connects to the vault withdrawals. Rekt noted that investigations were ongoing.

Timeline and Loss

The loss and the response, with each claim attributed:

• Total: about $81.5M, per Rekt and The Block. DefiLlama lists $81.7M.
• Investigation: Ozys said it was working with Theori, South Korean police and the Korea Internet & Security Agency.
• Attribution: Ozys said it was checking whether North Korea's Lazarus Group was involved, and had alerted the National Intelligence Service.
• Recovery: none is reported in the sources we read, through The Block's June 2024 report.

What It Shows

The root cause is open, so these are not verdicts on Orbit. They are questions the incident raises for any bridge.

Signers decide what the vault releases

Whatever the vector, the Ethereum vault released funds to the attacker. In a multisig vault, the signers' keys, hosts and networks hold that power.

Ronin and Harmony lost funds when attackers took signer keys. Our biggest bridge hacks ranking compares them.

Staff exits are access events

By Ozys's account, a firewall change sat unnoticed from November 22 to January 10. Any team can test how fast it would spot the same change.

Our insider threat guide covers what to cut and review when people leave.

Outflows need a brake

Rekt logs the DAI withdrawal at 21:08 UTC, the USDT at 21:25 and the shutdown at 22:21. Per-asset rate limits cap what one window can take.

Checks to run

• Map each signer key: where it lives, and which networks reach its host.
• Test what a partly compromised signer set can force.
• Alert on firewall, VPN and IAM changes near signer infrastructure.
• Review every access and configuration change made by departing security staff.
• Rate-limit vault withdrawals per asset and per hour.
• Alert on large vault outflows, and rehearse shutting the bridge.

Our bridge security guide covers verifier and signer design in more depth.

How Guardian Tests Bridge Signers

Guardian's Offchain Automation Pentest covers keepers, relayers, bots and threshold signers. They "use real privileges unattended," and Guardian tests them "with hostile inputs and a partly compromised set."

For bridge signers, its threshold signing scope covers:

• Share storage and participant authentication.
• What a sub-threshold subset can force.
• Recovery after a node is compromised.

It also covers failure behavior: whether a stuck or spammed job halts safely, and how an operator steps in mid-incident. Source code access is required.

The hosts and networks around signers fall under the Infrastructure Pentest. It covers IAM and trust policies, what one stolen key unlocks, and what survives an employee leaving.

Frequently Asked Questions

What happened in the Orbit Bridge hack?

On December 31, 2023 (UTC), about $81.5M in USDT, USDC, DAI, wBTC and ETH was withdrawn from Orbit Bridge's Ethereum vault, Rekt reported. Orbit called it an unidentified access, and the bridge was deactivated at 22:21 UTC.

Was the Orbit Bridge hack caused by compromised multisig keys?

That was the first assumption, per Rekt, but the vector is unpublished. Orbit later said it did not result from a validator key theft, and Ozys alleged its former CISO weakened the firewall. None of this is confirmed.

Who was behind the Orbit Bridge hack?

No attacker is confirmed in the sources we read. Ozys said it was checking whether North Korea's Lazarus Group was involved and had alerted the National Intelligence Service. It also sued its former CISO and asked police to investigate.

Sources

• Rekt: Orbit Bridge, Rekt (January 3, 2024)
• The Block: Orbit Chain's hacked funds 'remain unmoved' following $81 million exploit (January 2, 2024)
• The Block: Former Ozys security chief accused of sabotaging firewall before $81.5 million Orbit bridge exploit (January 25, 2024)
• crypto.news: Ex-Orbit Bridge employee accused of facilitating $80m attack (January 25, 2024)
• ForkLog: Former Orbit Bridge Employee Suspected of Aiding $80 Million Attack (January 25, 2024)
• The Block: Orbit Chain exploiter moves $48 million through Tornado Cash after months of post-hack dormancy (June 9, 2024)
• DefiLlama: Hacks dataset API (pulled November 6, 2026)
• Guardian: Offchain Automation Pentest
• Guardian: Cloud and Infrastructure Penetration Testing