Harmony Horizon Bridge incident, 2022-06-23

Horizon's Ethereum side was controlled by a multisig of bridge validators, and only a small number of signatures — Harmony's own summary says the attackers compromised "at least two out of four" keys — were needed to move funds (Harmony forum). On-chain, the Ethereum multisig required 2 of its 4 owners just before the attack (Blockscout), not the 2-of-5 often reported. Harmony believes a developer was phished into installing malware, which let the attackers read internal chats, access non-public bridge code and gain backdoor server access, where the encrypted keys could be decrypted. The contracts and the Harmony chain were not compromised.

This is the most common failure mode among large bridge thefts: a low signing threshold held by people inside one organisation, protected by operational security rather than cryptography. The same group was later linked to other bridge thefts, and the FBI tracked the proceeds publicly.

A larger threshold spread across independent organisations, hardware-backed signing and withdrawal rate limits are the standard mitigations; none would have made a phishing attack impossible, but each would have raised the number of organisations the attacker needed to breach.

Harmony's case also shows how long the aftermath lasts. Seven months later the stolen ETH was still being laundered and tracked by the FBI, while bridged tokens on Harmony traded far below their nominal value. For users, the practical loss was not only the theft but the collapse of every asset that depended on the bridge.

At the time

Users could not defend against key theft, but they could limit exposure: holding bridged "1"-prefixed tokens on Harmony meant trusting a multisig with a very low signing threshold. Treating such a threshold as a red flag and keeping balances small was the practical defence.

Now

Before using any multisig-secured bridge, look up its threshold and signer list (L2Beat and the project's docs usually list them). A threshold of two, or signers from one company, is a reason to bridge only what you need and move it on promptly.