The Horizon Bridge to the Harmony layer-1 blockchain has been exploited for $100 million in altcoins which are being swapped for Ether (ETH).
The hack may vindicate previously raised community concerns about the robustness of the two of four multisig that reportedly secures the bridge.
Starting at about 7:08 am EST until 7:26 am EST, 11 transactions were napravljen from the bridge for various tokens. They have since begun slanje tokens to a different wallet to swap for ETH on the Uniswap decentralizirana razmjena (DEX), then sending the ETH back to the original wallet.
1/ Harmony tim je identifikovao krađu koja se dogodila jutros na mostu Horizon u iznosu od cca. $100MM. Počeli smo da radimo sa nacionalnim vlastima i forenzičkim stručnjacima na identifikaciji krivca i povratku ukradenih sredstava.
više
— Harmony (@harmonyprotocol) Juni 23, 2022
So far, Frax (FRAX), Wrapped Ether (wETH). Aave (GHOST), SushiSwap (SUSHI), Frax Share (FXS), AAG (AAG), Binance USD (BUSD), Dai (DAI), Tether (USDT), Wrapped BTC (wBTC) and USD Coin (USDC) have been stolen from the bridge through this exploit.
The Horizon Bridge facilitates token transfers between Harmony and the Ethereum network, Binance Chain and Bitcoin. Harmony, the operator of the bridge, objavio late on Thursday that the bridge has been halted. It said the BTC bridge and its assets have not been affected by the attack.
The Harmony team also said it was working with “national authorities and forensic specialists” to determine who was responsible. A post-mortem is sure to follow.
The developers and the co-founder of Harmony, Nick White, did not respond to requests for comment. Harmony is a layer-1 blockchain using proof-of-stake (PoS) consensus. Its native token is ONE.
Concerns have previously been expressed as to the soundness of Horizon’s multisig wallet on Ethereum, which only required two out of the four signees to drain the funds. A founder of Chainstride Capital crypto-focused venture fund Ape Dev primećeno on Twitter on April 2 that the low number of required signers would leave the bridge open for “another 9 figure hack.”
The security of the bridge is currently predicated on a multisig wallet deployed at 0x715CdDa5e9Ad30A0cEd14940F9997EE611496De6. It has four owners, two of which are required to consent in order to execute an arbitrary transaction (i.e. drain the $330m). pic.twitter.com/sgYmyPrYgf
— Majmun Dev (@_apedev) April 1, 2022
Ape Dev’s prediction appears to have become a reality as the bridge is now down $100 million in assets.
He is far from the only developer in crypto to have qualms with the security of token bridges.
Vitalik Buterin discussed the issues with token bridges in a Reddit post this January. He posited that when bridges get exploited, it threatens the liquidity of each chain affected. He added that as the amount of token bridges increases, the threat of a 51% attack on one chain could present a greater contagion risk to others.
Since his prediction, Meter’s token bridge, Axie Inifinity’s Ronin Bridge and the Wormhole Bridge were each exploited for nearly a combined $1 billion.
Nacionalne vlasti i forenzički stručnjaci bi trebali istražiti *vas* kako bi otkrili kakve su narušene sigurnosne prakse omogućile da se dogodi ova „krađa“.
- Chris Blec (@ChrisBlec) Juni 24, 2022
Multisignatures are an ongoing security issue in attacks. The Ronin Bridge was secured by nine validators, only five of which were required to verify a transaction. The attacker took control of the required five validators and extracted over $600 million in assets.
The market does not yet appear to have responded to the attack as prices of all the coins and tokens in question have not made a significant move. However, ONE has dropped 7.4% over the past 24 hours, with most of the fall coming in the past 5 hours. It is trading at $0.024 prema u CoinGecko.
Source: https://cointelegraph.com/news/breaking-harmony-one-s-horizon-bridge-hacked-for-100m