Harmony Horizon Bridge hack — June 2022
Incident facts
| Date of incident | |
|---|---|
| Target type | Cross-chain bridge |
| Loss | $99,700,000Published estimates range $99,700,000 to $100,000,000Price at time of incident |
| Recovered | $40,000,000 |
| Method | Private key compromiseControl of the bridge multisig obtained through compromised signer keys |
| Chains | Ethereum, Other |
| Attributed to | North Korea (Lazarus Group / APT38)Confirmed |
| Outcome | Partially recovered |
What happened
Harmony's Horizon bridge lost about $99.7m on 24 June 2022 after the attacker gained control of the multisig contract governing it and transferred out the assets it held.
The bridge required only two of five signatures, and those keys were concentrated enough that compromising a small number of individuals was sufficient. Social engineering of key holders is the method most consistent with the group later identified as responsible, though the specific compromise route has not been published in detail.
The proceeds were converted to Ether and moved through Tornado Cash, and a further tranche was routed through the RAILGUN privacy protocol. Roughly $40m was frozen or recovered with the cooperation of exchanges.
In January 2023 the FBI confirmed that Lazarus Group, associated with North Korea, was responsible, tying the incident to the same actors behind several other bridge thefts of the period.
Law enforcement
The FBI publicly attributed the theft to Lazarus Group in a press release in January 2023, following its investigation with partner agencies.
Sources
- Federal Bureau of InvestigationPrimary · retrieved 2026-08-01
- EllipticSecondary · retrieved 2026-08-01
- BleepingComputerSecondary · retrieved 2026-08-01
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Harmony Horizon Bridge hack — June 2022", iTokenly, accessed 2026-08-01, https://itokenly.com/hacks/harmony-horizon-bridgehttps://itokenly.com/hacks/harmony-horizon-bridgePermalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.