Harmony Hackers Send Stolen Funds to Tornado Cash Mixers

Funds from Harmony’s Horizon Bridge have begun entering the Tornado Cash Ethereum mixer, suggesting that the attackers have no intention of accepting the offered $1 million bounty.

The decision to cover up the illicit gains answers the question of whether the Harmony team providing just 1 percent of the $100 million in cryptocurrency funds stolen on June 24 was enough to convince the hackers to return the funds.

At 03:10 AM ET on June 28, 18,036.3 ETH worth approximately $21 million was transferred from the main wallet of the Horizon Bridge hacker. These funds were then divided equally three ways and sent to three different addresses in one transaction, through the next 10 hours.

Tornado Cash supports mixing up to 100 ETH at a time, which means large sums can easily take hours to mix. Mixing ETH is a privacy measure designed to obfuscate the transaction paths of tokens so that they cannot be traced back to previous transactions.

The first and second wallets that received ETH from the hacker’s main wallet have completed the mix and now have a total of 16.3 ETH left, which may be too little.

The third wallet is busy sending 100 ETH to Tornado every 8 minutes, with 2,800 tokens remaining as of this writing.

Cointelegraph has yet to hear back from the Harmony team as to how it plans to compensate the funds stolen from the bridge.

The project’s Twitter account reiterated on June 27 that the team is working with “two reputable blockchain tracking and analysis partners” and the FBI to investigate the hack.

About $80 million in ETH is still in the hacker's main wallet. They may return some of the stolen funds to Horizon, or they may take a break because it took the hackers more than 13 hours to mix the $21 million.

While the initial harvest was worth around $100 million at the time, rising ETH price volatility has increased the dollar value to $101.5 million.

Harmony founder Stephen Tse confirmed on June 25 that hackers took control of the two Horizon Bridge signers required for the multisig addresses used to secure funds. He noted that the ethereum side of the bridge affected by the bug has been moved to a more secure multi-signature wallet that requires four signers.

Horizon is the latest of a growing number of token bridges being attacked. The largest token bridge hacked was Poly Network in 2021, which lost $610 million but recovered almost all of it.

So far, over $1 billion has been withdrawn through underhanded means from Meter, Wormhole, Ronin, and now Horizon tokens through 2022.