Harmony、今日のHorizonブリッジハックで$100mを失う

Harmonyは、dAppの作成と利用を促進することを目的としたブロックチェーンプラットフォームで、今朝早くにハッキング攻撃を受けたことを発表しました。チームの発表によると、攻撃者はプロジェクトのHorizonブリッジを標的にし、約$100 million（1,148.63 ETH）を盗みました。

Harmonyはすでに調査を開始しました

While Harmony reported the incident soon after it happened, its team reacted quickly, and they first notified the proper authorities. In the initial announcement, Harmony noted that it already started the investigation, working with national authorities as well as forensic specialists in order to try and identify the culprit, and, if possible, retrieve the stolen funds.

https://twitter.com/harmonyprotocol/status/1540110924400324608

Following the initial announcement, Harmony managed to identify the 0x address that the attacker used, which was also shared in the next announcement.

https://twitter.com/harmonyprotocol/status/1540110926937894913

The address balance currently sits at 85,867.25322706327167346 Ether.

Soon after sharing the address, Harmony noted that the incident did not impact the trustless BTC bridge. The funds stored on this bridge, as well as all the assets stored within decentralized vaults remain untouched, and the team said that they are safe at this time.

Furthermore, Harmony’s team also notified the exchanges of the incident, and it halted the Horizon bridge for the time being, meaning that further transactions will not be possible until the team identifies and patches the vulnerability. The project added that “The team is all hands on deck as investigation continues.”

However, the project promised that it will continue to keep the community updated as new results of the investigation become apparent.

コミュニティのトークンブリッジに関する懸念が的中した

The hack may vindicate certain concerns that the community raised in the past, regarding the robustness of the two of four multisig that are securing the bridge. One mention of this came from Ape Dev, the founder of Chainstride Capital’s crypto-focused venture fund. Ape Dev stated back in early April that the low number of required signers will leave the bridge open for an attack.

https://twitter.com/_apedev/status/1510007665400950791

Ethereum’s Vitalik Buterin is another example, as he discussed the problems that token bridges are facing even earlier, back in January. Buterin noted that the bridges have a high likelihood of getting exploited, which threatens the liquidity of all affected chains.

https://twitter.com/VitalikButerin/status/1479501366192132099

The exploit has, so far, allowed the hacker to steal numerous tokens, including Frax (FRAX), Wrapped Ether (WETH), Sushi (SUSHI), Aave (AAVE), Binance USD (BUSD), Frax Share (FXS), Dai (DAI), AAG (AAG), Wrapped Bitcoin (WBTC), USD Coin (USDC), and Tether (USDT).

Starting at 7:08 AM ET and ending at 7:26 am, the attacker managed to make 11 transactions for the mentioned cryptocurrencies. The tokens were sent to different wallets to swap for ETH on Ethereum-based DEX, Uniswap, and then Ethereum was sent back to the original wallet.

The bridge currently enables seamless transfers between Harmony and several blockchains, including Ethereum, Bitcoin, and Binance Chain, with Harmony being the Bridge’s operator.

To learn more visit our Investing in Harmony guide.