Harmony Hackers Start Laundering Stolen ETH From Horizon Bridge

Harmony hackers started laundering the stolen ETH from the Horizon bridge and sent $36 million of the $100 million to a mixing service so lets read more today in our latest cryptocurrency news.

The hackers responsible for stealing $100 million in altcoins from the Harmony Horizon bridge started laundering the funds according to PeckShield. The hacker sent three transactions from the address used in the hack a few days ago that totaled up to $36M in ETH to the mixing service Tornado Cash with $64 million still in the hackers ETH wallet. Harmony is a layer 1 proof of stake blockchain that launched in 2019 and the bridge allows users to send crypto between blockchains such as Harmonys network and Binance chain, Bitcoin and Ethereum.

#PeckShieldAlert ~18k $ETH (~22m) into 0x1e…6430 from @harmonyprotocol exploiters pic.twitter.com/NN4j5Korsz

— PeckShieldAlert (@PeckShieldAlert) June 27, 2022

Crypto mixing services allow users to conceal the origins of the crypto by pooling significant amounts of the coins in a pool and mixing them as a process often used to launder illicit money. The hack resulted in $100 million in wrapped Ethereum, SUSHI, DAI, Aave, DAI, and Tether which were then swapped for Ethereum. Though initially reported as an exploit of the Harmony protocol, the company declared that it found no evidence of breaches of the smart contract codes nor vulnerabilities on the platform.

1/ The Harmony team has identified a theft occurring this morning on the Horizon bridge amounting to approx. $100MM. We have begun working with national authorities and forensic specialists to identify the culprit and retrieve the stolen funds.

More

— Harmony (@harmonyprotocol) June 23, 2022

The Harmony hack is the latest in the multi-million dollar attacks targeting DEFI protocols. In March we saw an attack on Axie Infinitys Ethereum sidechain ronin that was related to a North Korean hacking group. Harmony Protocol offered $1 million bounties for the return of the bridge funds and said the company will not advocate for criminal charges if the funds are returned. With the transfer from today, the offer has been rejected. After the hack, Harmony assured the users that the theft didnt impact its BTC bridge and that the company is working with national authoriteis to identify the attackers:

We have migrated the Ethereum side of the Horizon bridge to a 4-of-5 multisig since the incident. We will continue taking steps to further harden our operations and infrastructure security.

We commit to a $1M bounty for the return of Horizon bridge funds and sharing exploit information.

Contact us at [email protected] or ETH address 0xd6ddd996b2d5b7db22306654fd548ba2a58693ac.

Harmony will advocate for no criminal charges when funds are returned.

— Harmony (@harmonyprotocol) June 26, 2022

As recently reported, The hackers stole $100 million in AAve, SUSHI, DAI, Tether, USDC, and Wrapped Ethereum and then swapped them for Ethereum. The Harmony team since found the address of the hacker and it is working with national authoriteis and forensic specialists to retrieve the stolen funds. Harmony halted all Horizon bridge activity after the hack and its ONE token dipped as of the time of writing by 8.5% lower or to $0.02445 since the hack was discovered.