The Great Harmony Bridge Hack: Tracking the North Korean Lazarus Group’s Moves

Background of the Hack

On June 23, 2022, the Harmony bridge suffered a catastrophic breach, leading to a staggering theft of approximately $100 million. The culprits of this heist? None other than the infamous North Korean state-sponsored Lazarus Group. This attack wasn’t just a simple grab and run—funds were swiftly shuffled through various exchanges to frustrate tracking efforts.

The Tracking Efforts by MistTrack

MistTrack has taken the bull by the horns, releasing a list of 350 unique addresses tied to the stolen funds. In a surprising twist, they noted that the hackers initially switched their plunder into Bitcoin only to send it back to where it started—the audacity!

As revealed in a Twitter thread from January 23, these digital bandits have some sneaky moves. With about 85,700 Ether passing through the Tornado Cash mixer—known for its ability to anonymize transactions—they managed to build a formidable cover. The culmination of transactions finally made their way to the identified addresses by January 13.

From Harmony to Avalanche: The Journey of the Stolen Funds

Not content to let their ill-gotten gains just sit idle, the Lazarus Group went on a crypto adventure. Funds took a detour to the Avalanche blockchain, where they were transformed into Tether (USDT) or TRON’s USDD token before sneaking back into the Ethereum and TRON networks. If there were an award for the longest game of hide and seek in the crypto realm, this hack would be a front-runner!

Attempts to Recover Stolen Assets

In a glimmer of hope, Binance CEO Changpeng Zhao announced on January 15 that they had successfully managed to recover 121 BTC from the Huobi exchange. Let’s give a round of applause for cybersecurity efforts! However, recovering the full extent of losses remains a complex puzzle.

Future Plans and Community Reactions

Despite Harmony proposing the minting of new native ONE tokens to offset losses for the 65,000 impacted wallets, this idea wasn’t a crowd-pleaser. Instead, the company opted for a treasury plan to reimburse affected users. In November, Harmony announced a new LayerZero bridge, adding seven unaffected coins, allowing holders to move on from this calamity.

As the dust settles, the tale of the Harmony bridge hack serves as a haunting reminder of the complexities of crypto security and the lengths that unscrupulous actors will go to keep their identities under wraps.