Orbit Bridge hack — December 2023

Orbit Bridge, the cross-chain bridge run by South Korean developer Ozys as part of the Orbit Chain project, lost roughly $81.5 million from its Ethereum vault. Ozys CEO Jinhan Choi said the theft happened in six incidents between 05:52 and 06:25 KST on 1 January 2024 — the evening of 31 December 2023 UTC — and took ETH, WBTC, USDT, USDC and DAI. The vault was shut down at 07:21 KST. Published totals range from about $81 million to $82 million depending on how the assets were priced; CoinDesk measured net outflows from Orbit Chain at $81.88 million.

The mechanism has never been fully explained. Ozys stated that the exploit "did not result from a vulnerability in the Orbit Bridge smart contract or the theft of a validator key," which leaves the question of how the withdrawals were authorised open. The Block reported that the exact nature of the hack remained unknown.

On 25 January 2024 Jinhan Choi published a further statement saying the breach was not the result of an oversight by Ozys but "a deliberate act" by the company's former chief information security officer, who had made unauthorised changes to firewall settings in late November 2023 around the time he resigned, left on 6 December 2023 without a handover, and whose changes went undetected until 10 January 2024. Ozys said it had taken legal action against him and asked South Korean police to investigate his potential involvement in the hack. Secondary reports disagree on the sequence: CoinGape places the firewall change on 22 November, two days after the resignation request, while CoinSense places the change on 20 November, two days before it. No charges against him have been reported and no source establishes that he carried out the theft.

The stolen assets were swapped into ETH and DAI, split across eight addresses and left untouched for months. On 8 June 2024 the exploiter moved about $48 million through Tornado Cash, per Arkham Intelligence data reported by The Block. Reports that the methodology resembled DPRK-linked Lazarus Group activity prompted Ozys to notify South Korean authorities. Nothing has been recovered.