- Concord’s cross-chain bridge Horizon has been exploited for round $100 million in numerous tokens.
- The attacker has bought all stolen funds for Ethereum, however is to launder them by a privacy-protocol like Twister Money.
- The Concord group is reportedly working with the Federal Bureau of Investigation and a number of cyber safety companies to establish the attacker.
Share this text
The Concord group has confirmed the Horizon bridge has been exploited for about $100 million in numerous tokens.
Concord Bridge Hit for $100M
Concord, an EVM-compatible Proof-of-Stake blockchain, has had its Horizon cross-chain bridge exploited in a serious safety breach.
1/ The Concord group has recognized a theft occurring this morning on the Horizon bridge amounting to approx. $100MM. We have now begun working with nationwide authorities and forensic specialists to establish the offender and retrieve the stolen funds.
— Concord 💙 (@harmonyprotocol) June 23, 2022
The Concord group confirmed in a Friday morning Twitter submit that Horizon, the bridge that connects the Concord community to BNB Chain and Ethereum, had been exploited for round $100 million in numerous tokens. “The Concord group has recognized a theft occurring this morning on the Horizon bridge amounting to approx. $100MM,” a submit from the official Concord Twitter account mentioned, including that it’s already working with nationwide authorities and forensic consultants to establish the attacker and doubtlessly retrieve the stolen funds.
Based on on-chain information, the exploit started at round 12:02 UTC on Thursday and lasted for about 15 hours. The attacker executed 16 malicious transactions of assorted sizes, starting from 14,190 to 30 ETH earlier than the Concord group seen the assault and halted the Horizon bridge to forestall additional malicious transactions. After stealing roughly $100 million price of assorted tokens, together with Frax, Frax Shares, wrapped Ethereum, wrapped Bitcoin, Aave, Sushi, Tether, and Binance USD, the attacker despatched them to totally different wallets, swapped them for Ethereum on the decentralized trade Uniswap, after which transferred the stolen funds again to the originating wallet.
Unusual for most of these exploits, the attacker has not but tried to anonymize the stolen funds by a privacy-protocol like Twister Money. In a follow-up Tweet, the Concord group acknowledged that it’s working with the Federal Bureau of Investigation and a number of cyber safety companies to trace and establish the attacker. The involvement from U.S. authorities means there’s a chance that the Workplace of International Property Management will add the attacker’s pockets to its sanctioned addresses blacklist, successfully disabling it from laundering the stolen funds by Twister Money.
Whereas Concord hasn’t but shared particular particulars about how the exploit occurred, blockchain safety consultants have speculated that the attacker doubtless gained entry to a minimum of two of the 5 personal keys of the multi-signature pockets controlling the Horizon bridge sensible contracts. This assault vector was already highlighted in April by Ape Dev, the pseudonymous founding father of the crypto-focused enterprise agency Chainstride Capital. They mentioned that they had investigated the Concord bridge on Ethereum and located that “if two of the 4 multisig signers are compromised, we’re going to see one other 9 determine hack,” which seems to be exactly what occurred yesterday.
Mudit Gupta, the chief data safety officer at Polygon, commented that this was not a “blockchain hack” however a “conventional hack,” and speculated that the attacker doubtless compromised the servers internet hosting the keys of Horizon’s multi-signature pockets. “As soon as contained in the server, they may entry the keys that have been stored in plaintext for signing legit transactions,” he mentioned, including that the exploit is “eerily comparable” to Axie Infinity’s $551.8-million Ronin Community exploit from March. In April, the U.S. Treasury Division confirmed that North Korea’s state-sponsored cybercrime group generally known as Lazarus Group was behind the Ronin Community exploit.
Concord acknowledged that its trustless Bitcoin bridge was unaffected by the exploit and that it could proceed to replace the general public with new data because it is available in.
Disclosure: On the time of writing, the writer of this piece owned ETH and several other different cryptocurrencies.