Harmony Attacker Moves Over $44M Worth of Stolen Ether; Authorities Alerted

Harmony is working with two blockchain tracing and analysis firms and collaborating with the FBI, developers said.

AccessTimeIconJun 28, 2022 at 9:30 a.m. UTC
Updated May 11, 2023 at 4:41 p.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global hub for everything crypto, blockchain and Web3.Register Now

The attacker behind last week’s $100 million exploit on the Harmony network started moving funds worth millions of dollars in cryptocurrencies Monday night, blockchain data shows.

Harmony is aware of the movement and is collaborating with blockchain analysis firms and the U.S. Federal Bureau of Investigation (FBI) to catch the culprit, developers said in a tweet on Tuesday morning. The exploited "Horizon" bridge allowed users to exchange assets, such as tokens, stablecoins and non-fungible tokens (NFT), among the Ethereum, Binance Smart Chain (BSC) and Harmony blockchains.

Blockchain data shows the exploiter wallet marked “Horizon Bridge Exploiter” moved over 36,000 ether (ETH), worth over $44 million, in the past 26 hours.

On Monday, the exploiter moved over 18,000 ether (ETH), worth over $22 million at the time of writing, to three wallets. The coins were then sent to Tornado Cash, with the three wallets holding only a few ether as of writing time.

Over 36,000 ether have been moved in the past 24 hours. (Etherscan)

In Asian hours on Tuesday, the exploiter moved another 18,000 ether to yet another wallet. From that, some 6,000 ether was then moved to a separate “0x89f89d61644c6e606efb25a01210159f102fbd8b” wallet.

The funds were then sent to privacy swap service Tornado Cash in batches of 100 ether each, blockchain data shows. Over 1,200 ether, worth just over $1.4 million, passed through Tornado Cash at press time.

Various wallets received over 6,000 ether in the past 24 hours each. (Etherscan)
Various wallets received over 6,000 ether in the past 24 hours each. (Etherscan)

Tornado Cash breaks the on-chain link between a source and a destination address. This allows exploiters and hackers to mask their addresses while withdrawing illicitly gained funds.

The main exploiter wallet continues to hold over 49,000 ether, or over $59 million, as of early European hours on Tuesday. Meanwhile, the price of Harmony's native ONE token slumped nearly 9% to 2 cents in the past 24 hours.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Shaurya Malwa

Shaurya is the Deputy Managing Editor for the Data & Tokens team, focusing on decentralized finance, markets, on-chain data, and governance across all major and minor blockchains.

Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.

Read more about