Skip to content
The Canadian DeFi rulebook · rules checked 2026-11-01 · what changedEducation only · not financial, tax or legal advice
Menu
Incident · Bridge exploit · Jun 2022

Harmony Horizon bridge hack: what happened and what it teaches

Mitey the yeti talking a plan through with an older yeti, with a bridge
Mitey says: Not a story to scare you. A checklist of what to look for next time.

Attackers compromised private keys controlling Harmony's Horizon bridge and drained about US$100 million; the FBI attributed it to North Korea's Lazarus Group.

What happened

On June 23, 2022, 11 transactions extracted tokens from the bridge’s Ethereum side after private keys were compromised. The keys had been encrypted, but the attacker was able to decrypt several of them (project's own account). Harmony then moved to a 4-of-5 multisig.

On January 23, 2023 the FBI attributed the theft to the Lazarus Group and said over US$60 million was laundered through a privacy protocol on January 13, 2023; some funds were frozen with the help of virtual asset service providers.

Scale, from official records

  • US$100 million of virtual currency (FBI, 2023-01-23)

The Canadian angle

Global reference case; no Canadian-specific angle sourced.

What broke

Multisig signing keys held by one operator were compromised.

What a user could have checked

  • The multisig threshold and whether signers are independent of each other.
  • Whether the operator publishes its key-management controls.

Recovery

The FBI mentions partial freezes without an amount; overall recovery not confirmed.

Sources

Education only. Nothing on this page is financial, investment, tax or legal advice, or a recommendation to buy, sell, stake, lend or borrow any crypto-asset. Crypto-assets can lose some or all of their value and are not covered by CDIC. Canadian rules change: check the dated sources above and talk to a qualified professional about your situation. Full disclaimer.