Harmony Attacker Moves Over $44M Worth of Stolen Ether, Authorities Alerted

The attacker behind last week’s $100 million exploit on the Harmony network started moving funds worth millions of dollars in cryptocurrencies last night, blockchain data shows.

Harmony is aware of the movement and is collaborating with blockchain analysis firms and the Federal Investigation Bureau (FBI) to catch the culprit, developers said in a tweet on Tuesday morning. The exploited “Horizon” bridge allowed users to exchange assets, such as tokens, stablecoins and non-fungible tokens (NFTs), between the Ethereum, Binance Smart Chain (BSC) and Harmony blockchains.

Blockchain data shows that the exploiter wallet marked “Horizon Bridge Exploiter” moved over 36,000 ether (ETH), worth over $44 million, in the past 26 hours.

On Monday, the exploiter moved over 18,000 ether, worth over $22 million at the time of writing, to three wallets. The coins were then sent to Tornado Cash, with the three wallets holding only a few ether at writing time.

In Asian hours on Tuesday, the exploiter moved another 18,000 ether to yet another wallet. From that, some 6,000 ether was then moved to a separate “0x89f89d61644c6e606efb25a01210159f102fbd8b” wallet.

The funds were then sent to privacy swap service Tornado Cash in batches of 100 ether each, blockchain data shows. Over 1,200 ether, worth just over $1.4 million, passed through Tornado Cash at press time.

Tornado Cash breaks the on-chain link between a source and a destination address. This allows exploiters and hackers to mask their addresses while withdrawing illicitly gained funds.

The main exploiter wallet continues to hold over 49,000 ether, or over $59 million, as of early European hours on Tuesday. Meanwhile, the price of Harmony’s native ONE token slumped nearly 9% to 2 cents in the past 24 hours.