Harmony stops its Horizon bridge between Ethereum, Binance Chain, and Bitcoin after a theft of ~$100M in altcoins; Harmony says its BTC bridge was not impacted

The layer-1 blockchain's main bridge between Ethereum, Binance Chain, and Bitcoin has been exploited for nine figures, but says its BTC bridge has not been affected.

Cointelegraph 2022-06-25 Brian Newar

Context & Ripple Effects

Harmony’s halt follows a run of bridge exploits that had already exceeded $1B in stolen crypto while more than $21B was locked on Ethereum bridges, making Horizon part of a broader security problem in cross-chain infrastructure. Harmony’s assertion that its BTC bridge was unaffected narrows the immediate operational scope, but does not restore the compromised Ethereum–Binance Chain route.

Later coverage tied the theft to North Korea-backed Lazarus and APT38 and documented exchanges freezing assets traced to the attack, showing that recovery depended on actors beyond Harmony’s own network.

First-order effects

Harmony has stopped Horizon transfers between Ethereum and Binance Chain after the theft, interrupting the bridge’s core cross-chain function while it addresses the exploit.
Harmony’s unaffected BTC bridge remains distinct from the compromised route, giving BTC-bridge users a different immediate risk and service status from Horizon users.

Second-order effects

The incident adds urgency for bridge operators to prove their security controls as users and liquidity providers reassess exposure to cross-chain contracts after repeated large thefts.
Exchanges become a practical recovery chokepoint when stolen assets move outward: subsequent Binance and Huobi freezes of assets linked to the Harmony theft illustrate the role of centralized venues in limiting disposal of bridge-hack proceeds.

Third-order effects

Cross-chain bridges are emerging as concentrated security and custody points: assets may span multiple chains, but a compromise at the interoperability layer can disrupt access across them.
If large bridge losses persist, the market is likely to favor cross-chain designs and operators that can demonstrate stronger safeguards and coordinated incident-response channels over nominally broad connectivity.

The trend: Cross-chain interoperability is expanding crypto’s reachable liquidity while concentrating security risk in the bridges that connect separate networks.

Discussion

@harmonyprotocol @harmonyprotocol on x
1/ The Harmony team has identified a theft occurring this morning on the Horizon bridge amounting to approx. $100MM. We have begun working with national authorities and forensic specialists to identify the culprit and retrieve the stolen funds. More 🧵
@harmonyprotocol @harmonyprotocol on x
We are temporarily shifting our content and communication teams to assist in relaying communications internally and externally. Our #ONEWeekly will be postponed as we prioritize the investigation above all other efforts. Updates from the investigation team coming later today.
@matthew_d_green Matthew Green on x
It's increasingly obvious that there are attackers (including state-sponsored attackers) making lists of vulnerable “web3” services, ordered by target value and system vulnerability. And they are working systematically down those lists. Who is doing the same on defense?
@weldpond Chris Wysopal on x
Blockchain bridges are the latest target and weak point of crypto attackers. In software security, vulnerabilies often occur in the complexity of 2 different systems interfacing with each other. https://www.cnbc.com/...
@chainalysis @chainalysis on x
1/ What happened to Harmony's Horizon Bridge? We've investigated the theft with Storyline. https://twitter.com/...
@moonoverlord @moonoverlord on x
Kim Jong-un back at it https://twitter.com/...
@wublockchain Wu Blockchain on x
Certik: The attacker accomplished this by somehow controlling the owner of the MultiSigWallet to call the confirmTransaction() directly to transfer large amounts of tokens from the bridge on Harmony. https://www.certik.com/...
@matthew_d_green Matthew Green on x
“The third bridge of the top 10” to be looted. Just call the other seven bridge operators up and see which sound the *least* nervous. That's the next target. https://twitter.com/...
@mudit__gupta Mudit Gupta on x
This was not a “Blockchain Hack”. It was a “Traditional Hack” I've been begging protocols to focus on traditional security too alongside blockchain security for months now.... ps the convex compromise earlier today was also not blockchain related. https://twitter.com/...
@ryan_browne_ Ryan Browne on x
Another day, another mega crypto heist. Hackers made off with $100m after exploiting Horizon, a so-called blockchain “bridge.” Harmony, the company behind Horizon, said it's trying to retrieve the funds and is in contact with the FBI. More here: https://www.cnbc.com/...
@to @to on x
The only way to stop this bloodshed is to abandon EVM for good EVM is complete garbage for building a secure a decentralized Web3 https://twitter.com/...
@harmonyprotocol Harmony on x
We will be updating this blog with all new information and developments as the #HarmonyONE team works round the clock with our forensic partners and the FBI. https://medium.com/... https://twitter.com/...
@taosecurity Richard Bejtlich on x
As a follow-up to the last Tweet, more evidence cryptocurrency is currently a total failure. Once you accept the risk that you're in a Ponzi scheme, you then risk being cleaned out by another set of criminals. https://twitter.com/...
@wmiddelkoop Willem Middelkoop on x
What a (crypto) mess https://www.cnbc.com/...
@crypto @crypto on x
Another cryptocurrency bridge — an app that lets people swap coins between blockchains — is hacked, this one for $100 million https://www.bloomberg.com/...
@matthew_d_green Matthew Green on x
Another $100m gone, just like that. https://twitter.com/...
@ryan_browne_ Ryan Browne on x
@harmonyprotocol Horizon relied on a “multisig” wallet that required only two signatures in order to initiate transactions. One investor flagged concerns with this setup as early as April: https://twitter.com/...
@kyle_chasse @kyle_chasse on x
I've said this so many times, bridges are the most vulnerable tools in crypto, they are exploited time and time again. We need native communication between chains. #polkadot is the solution. https://twitter.com/...
@kevinsekniqi @kevinsekniqi on x
“Bridge hack” aka another badly implemented smart contract. Everything is a smart contracts. Stop writing bad smart contracts. https://twitter.com/...

Chronicles