What can we learn from the biggest crypto bridge hacks?

A bad year for bridges

In August 2022, Chainalysis estimated that about $2 billion had been stolen in 13 bridge hacks, most of it that year.¹ It said attacks on bridges made up 69% of all funds stolen in 2022 up to then.¹

Ronin: five keys out of nine

The Ronin Network served players of the game Axie Infinity.² On 23 March 2022, attackers drained 173,600 ETH and 25.5 million USDC from the Ronin bridge, in two transactions.² The US Treasury put the theft at almost $620 million.⁵

The attacker got control of five of the bridge's nine validator keys, which was enough to fake withdrawals.² Four of those five keys belonged to one company, Sky Mavis.²

• How they got in: Sky Mavis says its staff faced constant spear-phishing attacks and one employee was compromised; the attacker used that access to reach the validator nodes.²
• The fifth key: an old permission, given in November 2021 to help with heavy traffic, was never removed when that help ended.²
• Nobody noticed: the hack was found only on 29 March, six days later, because there was no proper system watching for large outflows.²

Who was blamed. On 14 April 2022, the FBI said Lazarus Group and APT38, hackers linked to North Korea, were responsible for the theft of $620 million in Ethereum reported on 29 March.⁶ The FBI's statement does not name the project.⁶ The US Treasury said Lazarus Group carried out the theft, from a blockchain project linked to Axie Infinity.⁵ Ronin's own post-mortem says the FBI attributed the Ronin breach to Lazarus Group.²

Wormhole: a check that didn't check

On 2 February 2022, an attacker used a flaw in Wormhole's signature checking on Solana. It let them mint 120,000 wrapped ETH that had no ETH behind them.³ The attacker took 93,750 of these to Ethereum and swapped them for real ETH from the bridge.³ ethereum.org puts the theft at about $325 million.⁷

Jump Crypto then put 120,000 ETH back in, so every wrapped token was backed again.³

Harmony: stolen keys again

In June 2022, about $100 million was taken from Harmony's Horizon bridge.⁸ Harmony said it found evidence that private keys had been stolen, and no evidence of a flaw in its smart contract code.⁸ After the attack, it changed the Ethereum side of the bridge so that four of five signers must approve.⁸

In January 2023, the FBI said the North Korean group Lazarus, also known as APT38, was responsible.⁹

Nomad: one bad upgrade

In early August 2022, the Nomad bridge was drained. CNN reported that about $190 million was taken, citing a security firm, though Nomad had not confirmed the total.^10,1

Nomad's own analysis says a bug let messages through without proper checks, so anyone could forge one.⁴ The faulty code came in an upgrade on 21 June 2022. The change had been made during an audit of that upgrade.⁴ Nomad's "watchers" looked out for stolen keys, not for bugs in the contracts, so they did not act.⁴

Four hacks side by side

The lessons

• Spread out the keys. Ronin's attacker needed only five of nine keys, and four sat with one company.² Afterwards, Ronin raised its validators from 9 to 11.²
• Watch the money. Ronin went six days without noticing, because big outflows were not tracked.²
• Audits help, but they are not proof. Nomad's bug was in code made during an audit.⁴ Chainalysis argues that very thorough code audits should become the standard, while admitting they are not foolproof.¹
• Train people. Chainalysis says tricking staff has long been a favourite way in for North Korean-linked hackers, and teams should be trained on the warning signs.¹